Question: What are the benefits of Kubelet Checkpoint API?

Answer: Kubelet Checkpoint APIFEATURE STATE: Kubernetes v1.30 [beta] (enabled by default: true)Checkpointing a container is the functionality to create a stateful copy of a running container. Once you have a stateful copy of a container, you could move it to a different computer for debugging or similar purposes.If you move the checkpointed container data to a computer that's able to restore it, that restored container continues to run at exactly the same point it was checkpointed. You can also inspect the saved data, provided that you have suitable tools for doing so.Creating a checkpoint of a container might have security implications. Typically a checkpoint contains all memory pages of all processes in the checkpointed container. This means that everything that used to be in memory is now available on the local disk. This includes all private data and possibly keys used for encryption. The underlying CRI implementations (the container runtime on that node) should create the checkpoint archive to be only accessible by the root user. It is still important to remember if the checkpoint archive is transferred to another system all memory pages will be readable by the owner of the checkpoint archive.Operationspost checkpoint the specified containerTell the kubelet to checkpoint a specific container from the specified Pod.Consult the Kubelet authentication/authorization reference for more information about how access to the kubelet checkpoint interface is controlled.The kubelet will request a checkpoint from the underlying CRI implementation. In the checkpoint request the kubelet will specify the name of the checkpoint archive as checkpoint-<podFullName>-<containerName>-<timestamp>.tar and also request to store the checkpoint archive in the checkpoints directory below its root directory (as defined by --root-dir). This defaults to /var/lib/kubelet/checkpoints.The checkpoint archive is in tar format, and could be listed using an implementation of tar. The contents of the archive depend on the underlying CRI implementation (the container runtime on that node).HTTP RequestPOST /checkpoint/{namespace}/{pod}/{container}Parametersnamespace (in path): string, requiredNamespacepod (in path): string, requiredPodcontainer (in path): string, requiredContainertimeout (in query): integerTimeout in seconds to wait until the checkpoint creation is finished. If zero or no timeout is specified the default CRI timeout value will be used. Checkpoint creation time depends directly on the used memory of the container. The more memory a container uses the more time is required to create the corresponding checkpoint.Response200: OK401: Unauthorized404: Not Found (if the ContainerCheckpoint feature gate is disabled)404: Not Found (if the specified namespace, pod or container cannot be found)500: Internal Server Error (if the CRI implementation encounter an error during checkpointing (see error message for further details))500: Internal Server Error (if the CRI implementation does


Question: What is Kubelet Checkpoint API?

Answer: C h e c k p o i n t i n g   a   c o n t a i n e r   i s   t h e   f u n c t i o n a l i t y   t o   c r e a t e   a   s t a t e f u l   c o p y   o f   a   r u n n i n g   c o n t a i n e r .   O n c e   y o u   h a v e   a   s t a t e f u l   c o p y   o f   a   c o n t a i n e r ,   y o u   c o u l d   m o v e   i t   t o   a   d i f f e r e n t   c o m p u t e r   f o r   d e b u g g i n g   o r   s i m i l a r   p u r p o s e s .   I f   y o u   m o v e   t h e   c h e c k p o i n t e d   c o n t a i n e r   d a t a   t o   a   c o m p u t e r   t h a t ' s   a b l e   t o   r e s t o r e   i t ,   t h a t   r e s t o r e d   c o n t a i n e r   c o n t i n u e s   t o   r u n   a t   e x a c t l y   t h e   s a m e   p o i n t   i t   w a s   c h e c k p o i n t e d .   Y o u   c a n   a l s o   i n s p e c t   t h e   s a v e d   d a t a ,   p r o v i d e d   t h a t   y o u   h a v e   s u i t a b l e   t o o l s   f o r   d o i n g   s o .   C r e a t i n g   a   c h e c k p o i n t   o f   a   c o n t a i n e r   m i g h t   h a v e   s e c u r i t y   i m p l i c a t i o n s .   T y p i c a l l y   a   c h e c k p o i n t   c o n t a i n s   a l l   m e m o r y   p a g e s   o f   a l l   p r o c e s s e s   i n   t h e   c h e c k p o i n t e d   c o n t a i n e r .   T h i s   m e a n s   t h a t   e v e r y t h i n g   t h a t   u s e d   t o   b e   i n   m e m o r y   i s   n o w   a v a i l a b l e   o n   t h e   l o c a l   d i s k .   T h i s   i n c l u d e s   a l l   p r i v a t e   d a t a   a n d   p o s s i b l y   k e y s   u s e d   f o r   e n c r y p t i o n .   T h e   u n d e r l y i n g   C R I   i m p l e m e n t a t i o n s   ( t h e   c o n t a i n e r   r u n t i m e   o n   t h a t   n o d e )   s h o u l d   c r e a t e   t h e   c h e c k p o i n t   a r c h i v e   t o   b e   o n l y   a c c e s s i b l e   b y   t h e   r o o t   u s e r .   I t   i s   s t i l l   i m p o r t a n t   t o   r e m e m b e r   i f   t h e   c


Question: What is post checkpoint the specified container?

Answer: T e l l   t h e   k u b e l e t   t o   c h e c k p o i n t   a   s p e c i f i c   c o n t a i n e r   f r o m   t h e   s p e c i f i e d   P o d .   C o n s u l t   t h e   K u b e l e t   a u t h e n t i c a t i o n / a u t h o r i z a t i o n   r e f e r e n c e   f o r   m o r e   i n f o r m a t i o n   a b o u t   h o w   a c c e s s   t o   t h e   k u b e l e t   c h e c k p o i n t   i n t e r f a c e   i s   c o n t r o l l e d .   T h e   k u b e l e t   w i l l   r e q u e s t   a   c h e c k p o i n t   f r o m   t h e   u n d e r l y i n g   C R I   i m p l e m e n t a t i o n .   I n   t h e   c h e c k p o i n t   r e q u e s t   t h e   k u b e l e t   w i l l   s p e c i f y   t h e   n a m e   o f   t h e   c h e c k p o i n t   a r c h i v e   a s   c h e c k p o i n t - < p o d F u l l N a m e > - < c o n t a i n e r N a m e > - < t i m e s t a m p > . t a r   a n d   a l s o   r e q u e s t   t o   s t o r e   t h e   c h e c k p o i n t   a r c h i v e   i n   t h e   c h e c k p o i n t s   d i r e c t o r y   b e l o w   i t s   r o o t   d i r e c t o r y   ( a s   d e f i n e d   b y   - - r o o t - d i r ) .   T h i s   d e f a u l t s   t o   / v a r / l i b / k u b e l e t / c h e c k p o i n t s .   T h e   c h e c k p o i n t   a r c h i v e   i s   i n   t a r   f o r m a t ,   a n d   c o u l d   b e   l i s t e d   u s i n g   a n   i m p l e m e n t a t i o n   o f   t a r .   T h e   c o n t e n t s   o f   t h e   a r c h i v e   d e p e n d   o n   t h e   u n d e r l y i n g   C R I   i m p l e m e n t a t i o n   ( t h e   c o n t a i n e r   r u n t i m e   o n   t h a t   n o d e ) .


Question: What is HTTP Request?

Answer: P O S T   / c h e c k p o i n t / { n a m e s p a c e } / { p o d } / { c o n t a i n e r }


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d N a m e s p a c e p o d   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d P o d c o n t a i n e r   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d C o n t a i n e r t i m e o u t   ( i n   q u e r y ) :   i n t e g e r T i m e o u t   i n   s e c o n d s   t o   w a i t   u n t i l   t h e   c h e c k p o i n t   c r e a t i o n   i s   f i n i s h e d .   I f   z e r o   o r   n o   t i m e o u t   i s   s p e c i f i e d   t h e   d e f a u l t   C R I   t i m e o u t   v a l u e   w i l l   b e   u s e d .   C h e c k p o i n t   c r e a t i o n   t i m e   d e p e n d s   d i r e c t l y   o n   t h e   u s e d   m e m o r y   o f   t h e   c o n t a i n e r .   T h e   m o r e   m e m o r y   a   c o n t a i n e r   u s e s   t h e   m o r e   t i m e   i s   r e q u i r e d   t o   c r e a t e   t h e   c o r r e s p o n d i n g   c h e c k p o i n t .   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   p o d   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   c o n t a i n e r   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   t i m e o u t   ( i n   q u e r y ) :   i n t e g e r   T i m e o u t   i n   s e c o n d s   t o   w a i t   u n t i l   t h e   c h e c k p o i n t   c r e a t i o n   i s   f i n i s h e d .   I f   z e r o   o r   n o   t i m e o u t   i s   s p e c i f i e d   t h e   d e f a u l t   C R I   t i m e o u t   v a l u e   w i l l   b e   u s e d .   C h e c k p o i n t   c r e a t i o n   t i m e   d e p e n d s   d i r e c t l y   o n   t h e   u s e d   m e m o r y   o f   t h e   c o n t a i n e r .   T h e   m o r e   m e m o r y   a   c o n t a i n e r   u s e s   t h e   m o r e   t i m e   i s   r e q u i r e d   t o   c r e a t e   t h e   c o r r e s p o n d i n g   c h e c k p o i n t .


Question: What is Response?

Answer: 2 0 0 :   O K   4 0 1 :   U n a u t h o r i z e d   4 0 4 :   N o t   F o u n d   ( i f   t h e   C o n t a i n e r C h e c k p o i n t   f e a t u r e   g a t e   i s   d i s a b l e d )   4 0 4 :   N o t   F o u n d   ( i f   t h e   s p e c i f i e d   n a m e s p a c e ,   p o d   o r   c o n t a i n e r   c a n n o t   b e   f o u n d )   5 0 0 :   I n t e r n a l   S e r v e r   E r r o r   ( i f   t h e   C R I   i m p l e m e n t a t i o n   e n c o u n t e r   a n   e r r o r   d u r i n g   c h e c k p o i n t i n g   ( s e e   e r r o r   m e s s a g e   f o r   f u r t h e r   d e t a i l s ) )   5 0 0 :   I n t e r n a l   S e r v e r   E r r o r   ( i f   t h e   C R I   i m p l e m e n t a t i o n   d o e s   n o t   i m p l e m e n t   t h e   c h e c k p o i n t   C R I   A P I   ( s e e   e r r o r   m e s s a g e   f o r   f u r t h e r   d e t a i l s ) )


Question: What is kubectl plugin list?

Answer: kubectl plugin listSynopsisList all available plugin files on a user's PATH. To see plugins binary names without the full path use --name-only flag.Available plugin files are those that are: - executable - anywhere on the user's PATH - begin with "kubectl-"kubectl plugin list [flags] Examples # List all available plugins kubectl plugin list # List only binary names of available plugins without paths kubectl plugin list --name-only Options-h, --helphelp for list--name-onlyIf true, display only the binary name of each plugin, rather than its full pathParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-nam


Question: How does kubectl plugin list work?

Answer: kubectl plugin listSynopsisList all available plugin files on a user's PATH. To see plugins binary names without the full path use --name-only flag.Available plugin files are those that are: - executable - anywhere on the user's PATH - begin with "kubectl-"kubectl plugin list [flags] Examples # List all available plugins kubectl plugin list # List only binary names of available plugins without paths kubectl plugin list --name-only Options-h, --helphelp for list--name-onlyIf true, display only the binary name of each plugin, rather than its full pathParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-nam


Question: When would you use kubectl plugin list?

Answer: kubectl plugin listSynopsisList all available plugin files on a user's PATH. To see plugins binary names without the full path use --name-only flag.Available plugin files are those that are: - executable - anywhere on the user's PATH - begin with "kubectl-"kubectl plugin list [flags] Examples # List all available plugins kubectl plugin list # List only binary names of available plugins without paths kubectl plugin list --name-only Options-h, --helphelp for list--name-onlyIf true, display only the binary name of each plugin, rather than its full pathParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-nam


Question: What are the benefits of kubectl plugin list?

Answer: kubectl plugin listSynopsisList all available plugin files on a user's PATH. To see plugins binary names without the full path use --name-only flag.Available plugin files are those that are: - executable - anywhere on the user's PATH - begin with "kubectl-"kubectl plugin list [flags] Examples # List all available plugins kubectl plugin list # List only binary names of available plugins without paths kubectl plugin list --name-only Options-h, --helphelp for list--name-onlyIf true, display only the binary name of each plugin, rather than its full pathParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-nam


Question: What is Synopsis?

Answer: L i s t   a l l   a v a i l a b l e   p l u g i n   f i l e s   o n   a   u s e r ' s   P A T H .   T o   s e e   p l u g i n s   b i n a r y   n a m e s   w i t h o u t   t h e   f u l l   p a t h   u s e   - - n a m e - o n l y   f l a g .   A v a i l a b l e   p l u g i n   f i l e s   a r e   t h o s e   t h a t   a r e :   -   e x e c u t a b l e   -   a n y w h e r e   o n   t h e   u s e r ' s   P A T H   -   b e g i n   w i t h   " k u b e c t l - "   k u b e c t l   p l u g i n   l i s t   [ f l a g s ]


Question: What is Examples?

Answer: #   L i s t   a l l   a v a i l a b l e   p l u g i n s   k u b e c t l   p l u g i n   l i s t   #   L i s t   o n l y   b i n a r y   n a m e s   o f   a v a i l a b l e   p l u g i n s   w i t h o u t   p a t h s   k u b e c t l   p l u g i n   l i s t   - - n a m e - o n l y


Question: What is Options?

Answer: h e l p   f o r   l i s t   I f   t r u e ,   d i s p l a y   o n l y   t h e   b i n a r y   n a m e   o f   e a c h   p l u g i n ,   r a t h e r   t h a n   i t s   f u l l   p a t h


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   p l u g i n   -   P r o v i d e s   u t i l i t i e s   f o r   i n t e r a c t i n g   w i t h   p l u g i n s   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Installing Kubernetes with deployment tools?

Answer: Installing Kubernetes with deployment toolsThere are many methods and tools for setting up your own production Kubernetes cluster. For example:kubeadmCluster API: A Kubernetes sub-project focused on providing declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters.kops: An automated cluster provisioning tool. For tutorials, best practices, configuration options and information on reaching out to the community, please check the kOps website for details.kubespray: A composition of Ansible playbooks, inventory, provisioning tools, and domain knowledge for generic OS/Kubernetes clusters configuration management tasks. You can reach out to the community on Slack channel #kubespray.


Question: How does Installing Kubernetes with deployment tools work?

Answer: Installing Kubernetes with deployment toolsThere are many methods and tools for setting up your own production Kubernetes cluster. For example:kubeadmCluster API: A Kubernetes sub-project focused on providing declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters.kops: An automated cluster provisioning tool. For tutorials, best practices, configuration options and information on reaching out to the community, please check the kOps website for details.kubespray: A composition of Ansible playbooks, inventory, provisioning tools, and domain knowledge for generic OS/Kubernetes clusters configuration management tasks. You can reach out to the community on Slack channel #kubespray.


Question: When would you use Installing Kubernetes with deployment tools?

Answer: Installing Kubernetes with deployment toolsThere are many methods and tools for setting up your own production Kubernetes cluster. For example:kubeadmCluster API: A Kubernetes sub-project focused on providing declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters.kops: An automated cluster provisioning tool. For tutorials, best practices, configuration options and information on reaching out to the community, please check the kOps website for details.kubespray: A composition of Ansible playbooks, inventory, provisioning tools, and domain knowledge for generic OS/Kubernetes clusters configuration management tasks. You can reach out to the community on Slack channel #kubespray.


Question: What are the benefits of Installing Kubernetes with deployment tools?

Answer: Installing Kubernetes with deployment toolsThere are many methods and tools for setting up your own production Kubernetes cluster. For example:kubeadmCluster API: A Kubernetes sub-project focused on providing declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters.kops: An automated cluster provisioning tool. For tutorials, best practices, configuration options and information on reaching out to the community, please check the kOps website for details.kubespray: A composition of Ansible playbooks, inventory, provisioning tools, and domain knowledge for generic OS/Kubernetes clusters configuration management tasks. You can reach out to the community on Slack channel #kubespray.


Question: What is Installing Kubernetes with deployment tools?

Answer: T h e r e   a r e   m a n y   m e t h o d s   a n d   t o o l s   f o r   s e t t i n g   u p   y o u r   o w n   p r o d u c t i o n   K u b e r n e t e s   c l u s t e r .   F o r   e x a m p l e :   k u b e a d m C l u s t e r   A P I :   A   K u b e r n e t e s   s u b - p r o j e c t   f o c u s e d   o n   p r o v i d i n g   d e c l a r a t i v e   A P I s   a n d   t o o l i n g   t o   s i m p l i f y   p r o v i s i o n i n g ,   u p g r a d i n g ,   a n d   o p e r a t i n g   m u l t i p l e   K u b e r n e t e s   c l u s t e r s . k o p s :   A n   a u t o m a t e d   c l u s t e r   p r o v i s i o n i n g   t o o l .   F o r   t u t o r i a l s ,   b e s t   p r a c t i c e s ,   c o n f i g u r a t i o n   o p t i o n s   a n d   i n f o r m a t i o n   o n   r e a c h i n g   o u t   t o   t h e   c o m m u n i t y ,   p l e a s e   c h e c k   t h e   k O p s   w e b s i t e   f o r   d e t a i l s . k u b e s p r a y :   A   c o m p o s i t i o n   o f   A n s i b l e   p l a y b o o k s ,   i n v e n t o r y ,   p r o v i s i o n i n g   t o o l s ,   a n d   d o m a i n   k n o w l e d g e   f o r   g e n e r i c   O S / K u b e r n e t e s   c l u s t e r s   c o n f i g u r a t i o n   m a n a g e m e n t   t a s k s .   Y o u   c a n   r e a c h   o u t   t o   t h e   c o m m u n i t y   o n   S l a c k   c h a n n e l   # k u b e s p r a y .   k u b e a d m   C l u s t e r   A P I :   A   K u b e r n e t e s   s u b - p r o j e c t   f o c u s e d   o n   p r o v i d i n g   d e c l a r a t i v e   A P I s   a n d   t o o l i n g   t o   s i m p l i f y   p r o v i s i o n i n g ,   u p g r a d i n g ,   a n d   o p e r a t i n g   m u l t i p l e   K u b e r n e t e s   c l u s t e r s .   k o p s :   A n   a u t o m a t e d   c l u s t e r   p r o v i s i o n i n g   t o o l .   F o r   t u t o r i a l s ,   b e s t   p r a c t i c e s ,   c o n f i g u r a t i o n   o p t i o n s   a n d   i n f o r m a t i o n   o n   r e a c h i n g


Question: What is Networking on Windows?

Answer: Networking on WindowsKubernetes supports running nodes on either Linux or Windows. You can mix both kinds of node within a single cluster. This page provides an overview to networking specific to the Windows operating system.Container networking on WindowsNetworking for Windows containers is exposed through CNI plugins. Windows containers function similarly to virtual machines in regards to networking. Each container has a virtual network adapter (vNIC) which is connected to a Hyper-V virtual switch (vSwitch). The Host Networking Service (HNS) and the Host Compute Service (HCS) work together to create containers and attach container vNICs to networks. HCS is responsible for the management of containers whereas HNS is responsible for the management of networking resources such as:Virtual networks (including creation of vSwitches)Endpoints / vNICsNamespacesPolicies including packet encapsulations, load-balancing rules, ACLs, and NAT rules.The Windows HNS and vSwitch implement namespacing and can create virtual NICs as needed for a pod or container. However, many configurations such as DNS, routes, and metrics are stored in the Windows registry database rather than as files inside /etc, which is how Linux stores those configurations. The Windows registry for the container is separate from that of the host, so concepts like mapping /etc/resolv.conf from the host into a container don't have the same effect they would on Linux. These must be configured using Windows APIs run in the context of that container. Therefore CNI implementations need to call the HNS instead of relying on file mappings to pass network details into the pod or container.Network modesWindows supports five different networking drivers/modes: L2bridge, L2tunnel, Overlay (Beta), Transparent, and NAT. In a heterogeneous cluster with Windows and Linux worker nodes, you need to select a networking solution that is compatible on both Windows and Linux. The following table lists the out-of-tree plugins are supported on Windows, with recommendations on when to use each CNI:Network DriverDescriptionContainer Packet ModificationsNetwork PluginsNetwork Plugin CharacteristicsL2bridgeContainers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress.MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy.win-bridge, Azure-CNI, Flannel host-gateway uses win-bridgewin-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity.L2TunnelThis is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied.MAC rewritten, IP visible on the underlay networkAzure-CNIAzure-CNI allows integration of containers with Azure vNET, and allows them to leverage


Question: How does Networking on Windows work?

Answer: Networking on WindowsKubernetes supports running nodes on either Linux or Windows. You can mix both kinds of node within a single cluster. This page provides an overview to networking specific to the Windows operating system.Container networking on WindowsNetworking for Windows containers is exposed through CNI plugins. Windows containers function similarly to virtual machines in regards to networking. Each container has a virtual network adapter (vNIC) which is connected to a Hyper-V virtual switch (vSwitch). The Host Networking Service (HNS) and the Host Compute Service (HCS) work together to create containers and attach container vNICs to networks. HCS is responsible for the management of containers whereas HNS is responsible for the management of networking resources such as:Virtual networks (including creation of vSwitches)Endpoints / vNICsNamespacesPolicies including packet encapsulations, load-balancing rules, ACLs, and NAT rules.The Windows HNS and vSwitch implement namespacing and can create virtual NICs as needed for a pod or container. However, many configurations such as DNS, routes, and metrics are stored in the Windows registry database rather than as files inside /etc, which is how Linux stores those configurations. The Windows registry for the container is separate from that of the host, so concepts like mapping /etc/resolv.conf from the host into a container don't have the same effect they would on Linux. These must be configured using Windows APIs run in the context of that container. Therefore CNI implementations need to call the HNS instead of relying on file mappings to pass network details into the pod or container.Network modesWindows supports five different networking drivers/modes: L2bridge, L2tunnel, Overlay (Beta), Transparent, and NAT. In a heterogeneous cluster with Windows and Linux worker nodes, you need to select a networking solution that is compatible on both Windows and Linux. The following table lists the out-of-tree plugins are supported on Windows, with recommendations on when to use each CNI:Network DriverDescriptionContainer Packet ModificationsNetwork PluginsNetwork Plugin CharacteristicsL2bridgeContainers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress.MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy.win-bridge, Azure-CNI, Flannel host-gateway uses win-bridgewin-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity.L2TunnelThis is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied.MAC rewritten, IP visible on the underlay networkAzure-CNIAzure-CNI allows integration of containers with Azure vNET, and allows them to leverage


Question: When would you use Networking on Windows?

Answer: Networking on WindowsKubernetes supports running nodes on either Linux or Windows. You can mix both kinds of node within a single cluster. This page provides an overview to networking specific to the Windows operating system.Container networking on WindowsNetworking for Windows containers is exposed through CNI plugins. Windows containers function similarly to virtual machines in regards to networking. Each container has a virtual network adapter (vNIC) which is connected to a Hyper-V virtual switch (vSwitch). The Host Networking Service (HNS) and the Host Compute Service (HCS) work together to create containers and attach container vNICs to networks. HCS is responsible for the management of containers whereas HNS is responsible for the management of networking resources such as:Virtual networks (including creation of vSwitches)Endpoints / vNICsNamespacesPolicies including packet encapsulations, load-balancing rules, ACLs, and NAT rules.The Windows HNS and vSwitch implement namespacing and can create virtual NICs as needed for a pod or container. However, many configurations such as DNS, routes, and metrics are stored in the Windows registry database rather than as files inside /etc, which is how Linux stores those configurations. The Windows registry for the container is separate from that of the host, so concepts like mapping /etc/resolv.conf from the host into a container don't have the same effect they would on Linux. These must be configured using Windows APIs run in the context of that container. Therefore CNI implementations need to call the HNS instead of relying on file mappings to pass network details into the pod or container.Network modesWindows supports five different networking drivers/modes: L2bridge, L2tunnel, Overlay (Beta), Transparent, and NAT. In a heterogeneous cluster with Windows and Linux worker nodes, you need to select a networking solution that is compatible on both Windows and Linux. The following table lists the out-of-tree plugins are supported on Windows, with recommendations on when to use each CNI:Network DriverDescriptionContainer Packet ModificationsNetwork PluginsNetwork Plugin CharacteristicsL2bridgeContainers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress.MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy.win-bridge, Azure-CNI, Flannel host-gateway uses win-bridgewin-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity.L2TunnelThis is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied.MAC rewritten, IP visible on the underlay networkAzure-CNIAzure-CNI allows integration of containers with Azure vNET, and allows them to leverage


Question: What are the benefits of Networking on Windows?

Answer: Networking on WindowsKubernetes supports running nodes on either Linux or Windows. You can mix both kinds of node within a single cluster. This page provides an overview to networking specific to the Windows operating system.Container networking on WindowsNetworking for Windows containers is exposed through CNI plugins. Windows containers function similarly to virtual machines in regards to networking. Each container has a virtual network adapter (vNIC) which is connected to a Hyper-V virtual switch (vSwitch). The Host Networking Service (HNS) and the Host Compute Service (HCS) work together to create containers and attach container vNICs to networks. HCS is responsible for the management of containers whereas HNS is responsible for the management of networking resources such as:Virtual networks (including creation of vSwitches)Endpoints / vNICsNamespacesPolicies including packet encapsulations, load-balancing rules, ACLs, and NAT rules.The Windows HNS and vSwitch implement namespacing and can create virtual NICs as needed for a pod or container. However, many configurations such as DNS, routes, and metrics are stored in the Windows registry database rather than as files inside /etc, which is how Linux stores those configurations. The Windows registry for the container is separate from that of the host, so concepts like mapping /etc/resolv.conf from the host into a container don't have the same effect they would on Linux. These must be configured using Windows APIs run in the context of that container. Therefore CNI implementations need to call the HNS instead of relying on file mappings to pass network details into the pod or container.Network modesWindows supports five different networking drivers/modes: L2bridge, L2tunnel, Overlay (Beta), Transparent, and NAT. In a heterogeneous cluster with Windows and Linux worker nodes, you need to select a networking solution that is compatible on both Windows and Linux. The following table lists the out-of-tree plugins are supported on Windows, with recommendations on when to use each CNI:Network DriverDescriptionContainer Packet ModificationsNetwork PluginsNetwork Plugin CharacteristicsL2bridgeContainers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress.MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy.win-bridge, Azure-CNI, Flannel host-gateway uses win-bridgewin-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity.L2TunnelThis is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied.MAC rewritten, IP visible on the underlay networkAzure-CNIAzure-CNI allows integration of containers with Azure vNET, and allows them to leverage


Question: What is Networking on Windows?

Answer: K u b e r n e t e s   s u p p o r t s   r u n n i n g   n o d e s   o n   e i t h e r   L i n u x   o r   W i n d o w s .   Y o u   c a n   m i x   b o t h   k i n d s   o f   n o d e   w i t h i n   a   s i n g l e   c l u s t e r .   T h i s   p a g e   p r o v i d e s   a n   o v e r v i e w   t o   n e t w o r k i n g   s p e c i f i c   t o   t h e   W i n d o w s   o p e r a t i n g   s y s t e m .


Question: What is Container networking on Windows?

Answer: N e t w o r k i n g   f o r   W i n d o w s   c o n t a i n e r s   i s   e x p o s e d   t h r o u g h   C N I   p l u g i n s .   W i n d o w s   c o n t a i n e r s   f u n c t i o n   s i m i l a r l y   t o   v i r t u a l   m a c h i n e s   i n   r e g a r d s   t o   n e t w o r k i n g .   E a c h   c o n t a i n e r   h a s   a   v i r t u a l   n e t w o r k   a d a p t e r   ( v N I C )   w h i c h   i s   c o n n e c t e d   t o   a   H y p e r - V   v i r t u a l   s w i t c h   ( v S w i t c h ) .   T h e   H o s t   N e t w o r k i n g   S e r v i c e   ( H N S )   a n d   t h e   H o s t   C o m p u t e   S e r v i c e   ( H C S )   w o r k   t o g e t h e r   t o   c r e a t e   c o n t a i n e r s   a n d   a t t a c h   c o n t a i n e r   v N I C s   t o   n e t w o r k s .   H C S   i s   r e s p o n s i b l e   f o r   t h e   m a n a g e m e n t   o f   c o n t a i n e r s   w h e r e a s   H N S   i s   r e s p o n s i b l e   f o r   t h e   m a n a g e m e n t   o f   n e t w o r k i n g   r e s o u r c e s   s u c h   a s :   V i r t u a l   n e t w o r k s   ( i n c l u d i n g   c r e a t i o n   o f   v S w i t c h e s ) E n d p o i n t s   /   v N I C s N a m e s p a c e s P o l i c i e s   i n c l u d i n g   p a c k e t   e n c a p s u l a t i o n s ,   l o a d - b a l a n c i n g   r u l e s ,   A C L s ,   a n d   N A T   r u l e s .   T h e   W i n d o w s   H N S   a n d   v S w i t c h   i m p l e m e n t   n a m e s p a c i n g   a n d   c a n   c r e a t e   v i r t u a l   N I C s   a s   n e e d e d   f o r   a   p o d   o r   c o n t a i n e r .   H o w e v e r ,   m a n y   c o n f i g u r a t i o n s   s u c h   a s   D N S ,   r o u t e s ,   a n d   m e t r i c s   a r e   s t o r e d   i n   t h e   W i n d o w s   r e g i s t r y   d a t a b a s e   r a t h e r   t h a n   a s   f i l e s   i n s i d e   / e t c ,   w h i c h   i s   h o w   L i n u x   s t o r e s   t h o s e   c o n f i g u r a t i o n s .   T h e


Question: What is Network modes?

Answer: W i n d o w s   s u p p o r t s   f i v e   d i f f e r e n t   n e t w o r k i n g   d r i v e r s / m o d e s :   L 2 b r i d g e ,   L 2 t u n n e l ,   O v e r l a y   ( B e t a ) ,   T r a n s p a r e n t ,   a n d   N A T .   I n   a   h e t e r o g e n e o u s   c l u s t e r   w i t h   W i n d o w s   a n d   L i n u x   w o r k e r   n o d e s ,   y o u   n e e d   t o   s e l e c t   a   n e t w o r k i n g   s o l u t i o n   t h a t   i s   c o m p a t i b l e   o n   b o t h   W i n d o w s   a n d   L i n u x .   T h e   f o l l o w i n g   t a b l e   l i s t s   t h e   o u t - o f - t r e e   p l u g i n s   a r e   s u p p o r t e d   o n   W i n d o w s ,   w i t h   r e c o m m e n d a t i o n s   o n   w h e n   t o   u s e   e a c h   C N I :   A s   o u t l i n e d   a b o v e ,   t h e   F l a n n e l   C N I   p l u g i n   i s   a l s o   s u p p o r t e d   o n   W i n d o w s   v i a   t h e   V X L A N   n e t w o r k   b a c k e n d   ( B e t a   s u p p o r t   ;   d e l e g a t e s   t o   w i n - o v e r l a y )   a n d   h o s t - g a t e w a y   n e t w o r k   b a c k e n d   ( s t a b l e   s u p p o r t ;   d e l e g a t e s   t o   w i n - b r i d g e ) .   T h i s   p l u g i n   s u p p o r t s   d e l e g a t i n g   t o   o n e   o f   t h e   r e f e r e n c e   C N I   p l u g i n s   ( w i n - o v e r l a y ,   w i n - b r i d g e ) ,   t o   w o r k   i n   c o n j u n c t i o n   w i t h   F l a n n e l   d a e m o n   o n   W i n d o w s   ( F l a n n e l d )   f o r   a u t o m a t i c   n o d e   s u b n e t   l e a s e   a s s i g n m e n t   a n d   H N S   n e t w o r k   c r e a t i o n .   T h i s   p l u g i n   r e a d s   i n   i t s   o w n   c o n f i g u r a t i o n   f i l e   ( c n i . c o n f ) ,   a n d   a g g r e g a t e s   i t   w i t h   t h e   e n v i r o n m e n t   v a r i a b l e s   f r o m   t h e   F l a n n e l D   g e n e r a t e d   s u b n e t . e n v   f i l e .   I t   t h e n   d


Question: What is IP address management (IPAM)?

Answer: T h e   f o l l o w i n g   I P A M   o p t i o n s   a r e   s u p p o r t e d   o n   W i n d o w s :   h o s t - l o c a l a z u r e - v n e t - i p a m   ( f o r   a z u r e - c n i   o n l y ) W i n d o w s   S e r v e r   I P A M   ( f a l l b a c k   o p t i o n   i f   n o   I P A M   i s   s e t )


Question: What is Direct Server Return (DSR)?

Answer: L o a d   b a l a n c i n g   m o d e   w h e r e   t h e   I P   a d d r e s s   f i x u p s   a n d   t h e   L B N A T   o c c u r s   a t   t h e   c o n t a i n e r   v S w i t c h   p o r t   d i r e c t l y ;   s e r v i c e   t r a f f i c   a r r i v e s   w i t h   t h e   s o u r c e   I P   s e t   a s   t h e   o r i g i n a t i n g   p o d   I P .   T h i s   p r o v i d e s   p e r f o r m a n c e   o p t i m i z a t i o n s   b y   a l l o w i n g   t h e   r e t u r n   t r a f f i c   r o u t e d   t h r o u g h   l o a d   b a l a n c e r s   t o   b y p a s s   t h e   l o a d   b a l a n c e r   a n d   r e s p o n d   d i r e c t l y   t o   t h e   c l i e n t ;   r e d u c i n g   l o a d   o n   t h e   l o a d   b a l a n c e r   a n d   a l s o   r e d u c i n g   o v e r a l l   l a t e n c y .   F o r   m o r e   i n f o r m a t i o n ,   r e a d   D i r e c t   S e r v e r   R e t u r n   ( D S R )   i n   a   n u t s h e l l .


Question: What is Load balancing and Services?

Answer: A   K u b e r n e t e s   S e r v i c e   i s   a n   a b s t r a c t i o n   t h a t   d e f i n e s   a   l o g i c a l   s e t   o f   P o d s   a n d   a   m e a n s   t o   a c c e s s   t h e m   o v e r   a   n e t w o r k .   I n   a   c l u s t e r   t h a t   i n c l u d e s   W i n d o w s   n o d e s ,   y o u   c a n   u s e   t h e   f o l l o w i n g   t y p e s   o f   S e r v i c e :   N o d e P o r t C l u s t e r I P L o a d B a l a n c e r E x t e r n a l N a m e   W i n d o w s   c o n t a i n e r   n e t w o r k i n g   d i f f e r s   i n   s o m e   i m p o r t a n t   w a y s   f r o m   L i n u x   n e t w o r k i n g .   T h e   M i c r o s o f t   d o c u m e n t a t i o n   f o r   W i n d o w s   C o n t a i n e r   N e t w o r k i n g   p r o v i d e s   a d d i t i o n a l   d e t a i l s   a n d   b a c k g r o u n d .   O n   W i n d o w s ,   y o u   c a n   u s e   t h e   f o l l o w i n g   s e t t i n g s   t o   c o n f i g u r e   S e r v i c e s   a n d   l o a d   b a l a n c i n g   b e h a v i o r :


Question: What is Limitations?

Answer: T h e   f o l l o w i n g   n e t w o r k i n g   f u n c t i o n a l i t y   i s   n o t   s u p p o r t e d   o n   W i n d o w s   n o d e s :   H o s t   n e t w o r k i n g   m o d e L o c a l   N o d e P o r t   a c c e s s   f r o m   t h e   n o d e   i t s e l f   ( w o r k s   f o r   o t h e r   n o d e s   o r   e x t e r n a l   c l i e n t s ) M o r e   t h a n   6 4   b a c k e n d   p o d s   ( o r   u n i q u e   d e s t i n a t i o n   a d d r e s s e s )   f o r   a   s i n g l e   S e r v i c e I P v 6   c o m m u n i c a t i o n   b e t w e e n   W i n d o w s   p o d s   c o n n e c t e d   t o   o v e r l a y   n e t w o r k s L o c a l   T r a f f i c   P o l i c y   i n   n o n - D S R   m o d e O u t b o u n d   c o m m u n i c a t i o n   u s i n g   t h e   I C M P   p r o t o c o l   v i a   t h e   w i n - o v e r l a y ,   w i n - b r i d g e ,   o r   u s i n g   t h e   A z u r e - C N I   p l u g i n .   S p e c i f i c a l l y ,   t h e   W i n d o w s   d a t a   p l a n e   ( V F P )   d o e s n ' t   s u p p o r t   I C M P   p a c k e t   t r a n s p o s i t i o n s ,   a n d   t h i s   m e a n s : I C M P   p a c k e t s   d i r e c t e d   t o   d e s t i n a t i o n s   w i t h i n   t h e   s a m e   n e t w o r k   ( s u c h   a s   p o d   t o   p o d   c o m m u n i c a t i o n   v i a   p i n g )   w o r k   a s   e x p e c t e d ; T C P / U D P   p a c k e t s   w o r k   a s   e x p e c t e d ; I C M P   p a c k e t s   d i r e c t e d   t o   p a s s   t h r o u g h   a   r e m o t e   n e t w o r k   ( e . g .   p o d   t o   e x t e r n a l   i n t e r n e t   c o m m u n i c a t i o n   v i a   p i n g )   c a n n o t   b e   t r a n s p o s e d   a n d   t h u s   w i l l   n o t   b e   r o u t e d   b a c k   t o   t h e i r   s o u r c e ; S i n c e   T C P / U D P   p a c k e t s   c a n   s t i l l   b e   t r a n s p o s e d ,   y o u   c a n   s u b s t i t u t e   p i n g   < d e s t i n a t i o n >   w


Question: What is kubectl set?

Answer: kubectl setSynopsisConfigure application resources.These commands help you make changes to existing application resources.kubectl set SUBCOMMAND Options-h, --helphelp for setParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version inf


Question: How does kubectl set work?

Answer: kubectl setSynopsisConfigure application resources.These commands help you make changes to existing application resources.kubectl set SUBCOMMAND Options-h, --helphelp for setParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version inf


Question: When would you use kubectl set?

Answer: kubectl setSynopsisConfigure application resources.These commands help you make changes to existing application resources.kubectl set SUBCOMMAND Options-h, --helphelp for setParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version inf


Question: What are the benefits of kubectl set?

Answer: kubectl setSynopsisConfigure application resources.These commands help you make changes to existing application resources.kubectl set SUBCOMMAND Options-h, --helphelp for setParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version inf


Question: What is Synopsis?

Answer: C o n f i g u r e   a p p l i c a t i o n   r e s o u r c e s .   T h e s e   c o m m a n d s   h e l p   y o u   m a k e   c h a n g e s   t o   e x i s t i n g   a p p l i c a t i o n   r e s o u r c e s .   k u b e c t l   s e t   S U B C O M M A N D


Question: What is Options?

Answer: h e l p   f o r   s e t


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   -   k u b e c t l   c o n t r o l s   t h e   K u b e r n e t e s   c l u s t e r   m a n a g e r k u b e c t l   s e t   e n v   -   U p d a t e   e n v i r o n m e n t   v a r i a b l e s   o n   a   p o d   t e m p l a t e k u b e c t l   s e t   i m a g e   -   U p d a t e   t h e   i m a g e   o f   a   p o d   t e m p l a t e k u b e c t l   s e t   r e s o u r c e s   -   U p d a t e   r e s o u r c e   r e q u e s t s / l i m i t s   o n   o b j e c t s   w i t h   p o d   t e m p l a t e s k u b e c t l   s e t   s e l e c t o r   -   S e t   t h e   s e l e c t o r   o n   a   r e s o u r c e k u b e c t l   s e t   s e r v i c e a c c o u n t   -   U p d a t e   t h e   s e r v i c e   a c c o u n t   o f   a   r e s o u r c e k u b e c t l   s e t   s u b j e c t   -   U p d a t e   t h e   u s e r ,   g r o u p ,   o r   s e r v i c e   a c c o u n t   i n   a   r o l e   b i n d i n g   o r   c l u s t e r   r o l e   b i n d i n g   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Utilizing the NUMA-aware Memory Manager?

Answer: Utilizing the NUMA-aware Memory ManagerFEATURE STATE: Kubernetes v1.32 [stable] (enabled by default: true)The Kubernetes Memory Manager enables the feature of guaranteed memory (and hugepages) allocation for pods in the Guaranteed QoS class.The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. The Memory Manager feeds the central manager (Topology Manager) with these affinity hints. Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node.Moreover, the Memory Manager ensures that the memory which a pod requests is allocated from a minimum number of NUMA nodes.The Memory Manager is only pertinent to Linux based hosts.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.32.To check the version, enter kubectl version.To align memory resources with other requested resources in a Pod spec:the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. See control CPU Management Policies;the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. See control Topology Management Policies.Starting from v1.22, the Memory Manager is enabled by default through MemoryManager feature gate.Preceding v1.22, the kubelet must be started with the following flag:--feature-gates=MemoryManager=truein order to enable the Memory Manager feature.How does the Memory Manager Operate?The Memory Manager currently offers the guaranteed memory (and hugepages) allocation for Pods in Guaranteed QoS class. To immediately put the Memory Manager into operation follow the guidelines in the section Memory Manager configuration, and subsequently, prepare and deploy a Guaranteed pod as illustrated in the section Placing a Pod in the Guaranteed QoS class.The Memory Manager is a Hint Provider, and it provides topology hints for the Topology Manager which then aligns the requested resources according to these topology hints. On Linux, it also enforces cgroups (i.e. cpuset.mems) for pods. The complete flow diagram concerning pod admission and deployment process is illustrated in Memory Manager KEP: Design Overview and below:During this process, the Memory Manager updates its internal counters stored in Node Map and Memory Maps to manage guaranteed memory allocation.The Memory Manager updates the Node Map during the startup and runtime as follows.StartupThis occurs once a node administrator employs --reserved-memory (section Reserved memory flag). In this case, the Node Map becomes update


Question: How does Utilizing the NUMA-aware Memory Manager work?

Answer: Utilizing the NUMA-aware Memory ManagerFEATURE STATE: Kubernetes v1.32 [stable] (enabled by default: true)The Kubernetes Memory Manager enables the feature of guaranteed memory (and hugepages) allocation for pods in the Guaranteed QoS class.The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. The Memory Manager feeds the central manager (Topology Manager) with these affinity hints. Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node.Moreover, the Memory Manager ensures that the memory which a pod requests is allocated from a minimum number of NUMA nodes.The Memory Manager is only pertinent to Linux based hosts.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.32.To check the version, enter kubectl version.To align memory resources with other requested resources in a Pod spec:the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. See control CPU Management Policies;the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. See control Topology Management Policies.Starting from v1.22, the Memory Manager is enabled by default through MemoryManager feature gate.Preceding v1.22, the kubelet must be started with the following flag:--feature-gates=MemoryManager=truein order to enable the Memory Manager feature.How does the Memory Manager Operate?The Memory Manager currently offers the guaranteed memory (and hugepages) allocation for Pods in Guaranteed QoS class. To immediately put the Memory Manager into operation follow the guidelines in the section Memory Manager configuration, and subsequently, prepare and deploy a Guaranteed pod as illustrated in the section Placing a Pod in the Guaranteed QoS class.The Memory Manager is a Hint Provider, and it provides topology hints for the Topology Manager which then aligns the requested resources according to these topology hints. On Linux, it also enforces cgroups (i.e. cpuset.mems) for pods. The complete flow diagram concerning pod admission and deployment process is illustrated in Memory Manager KEP: Design Overview and below:During this process, the Memory Manager updates its internal counters stored in Node Map and Memory Maps to manage guaranteed memory allocation.The Memory Manager updates the Node Map during the startup and runtime as follows.StartupThis occurs once a node administrator employs --reserved-memory (section Reserved memory flag). In this case, the Node Map becomes update


Question: When would you use Utilizing the NUMA-aware Memory Manager?

Answer: Utilizing the NUMA-aware Memory ManagerFEATURE STATE: Kubernetes v1.32 [stable] (enabled by default: true)The Kubernetes Memory Manager enables the feature of guaranteed memory (and hugepages) allocation for pods in the Guaranteed QoS class.The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. The Memory Manager feeds the central manager (Topology Manager) with these affinity hints. Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node.Moreover, the Memory Manager ensures that the memory which a pod requests is allocated from a minimum number of NUMA nodes.The Memory Manager is only pertinent to Linux based hosts.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.32.To check the version, enter kubectl version.To align memory resources with other requested resources in a Pod spec:the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. See control CPU Management Policies;the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. See control Topology Management Policies.Starting from v1.22, the Memory Manager is enabled by default through MemoryManager feature gate.Preceding v1.22, the kubelet must be started with the following flag:--feature-gates=MemoryManager=truein order to enable the Memory Manager feature.How does the Memory Manager Operate?The Memory Manager currently offers the guaranteed memory (and hugepages) allocation for Pods in Guaranteed QoS class. To immediately put the Memory Manager into operation follow the guidelines in the section Memory Manager configuration, and subsequently, prepare and deploy a Guaranteed pod as illustrated in the section Placing a Pod in the Guaranteed QoS class.The Memory Manager is a Hint Provider, and it provides topology hints for the Topology Manager which then aligns the requested resources according to these topology hints. On Linux, it also enforces cgroups (i.e. cpuset.mems) for pods. The complete flow diagram concerning pod admission and deployment process is illustrated in Memory Manager KEP: Design Overview and below:During this process, the Memory Manager updates its internal counters stored in Node Map and Memory Maps to manage guaranteed memory allocation.The Memory Manager updates the Node Map during the startup and runtime as follows.StartupThis occurs once a node administrator employs --reserved-memory (section Reserved memory flag). In this case, the Node Map becomes update


Question: What are the benefits of Utilizing the NUMA-aware Memory Manager?

Answer: Utilizing the NUMA-aware Memory ManagerFEATURE STATE: Kubernetes v1.32 [stable] (enabled by default: true)The Kubernetes Memory Manager enables the feature of guaranteed memory (and hugepages) allocation for pods in the Guaranteed QoS class.The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. The Memory Manager feeds the central manager (Topology Manager) with these affinity hints. Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node.Moreover, the Memory Manager ensures that the memory which a pod requests is allocated from a minimum number of NUMA nodes.The Memory Manager is only pertinent to Linux based hosts.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.32.To check the version, enter kubectl version.To align memory resources with other requested resources in a Pod spec:the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. See control CPU Management Policies;the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. See control Topology Management Policies.Starting from v1.22, the Memory Manager is enabled by default through MemoryManager feature gate.Preceding v1.22, the kubelet must be started with the following flag:--feature-gates=MemoryManager=truein order to enable the Memory Manager feature.How does the Memory Manager Operate?The Memory Manager currently offers the guaranteed memory (and hugepages) allocation for Pods in Guaranteed QoS class. To immediately put the Memory Manager into operation follow the guidelines in the section Memory Manager configuration, and subsequently, prepare and deploy a Guaranteed pod as illustrated in the section Placing a Pod in the Guaranteed QoS class.The Memory Manager is a Hint Provider, and it provides topology hints for the Topology Manager which then aligns the requested resources according to these topology hints. On Linux, it also enforces cgroups (i.e. cpuset.mems) for pods. The complete flow diagram concerning pod admission and deployment process is illustrated in Memory Manager KEP: Design Overview and below:During this process, the Memory Manager updates its internal counters stored in Node Map and Memory Maps to manage guaranteed memory allocation.The Memory Manager updates the Node Map during the startup and runtime as follows.StartupThis occurs once a node administrator employs --reserved-memory (section Reserved memory flag). In this case, the Node Map becomes update


Question: What is Utilizing the NUMA-aware Memory Manager?

Answer: T h e   K u b e r n e t e s   M e m o r y   M a n a g e r   e n a b l e s   t h e   f e a t u r e   o f   g u a r a n t e e d   m e m o r y   ( a n d   h u g e p a g e s )   a l l o c a t i o n   f o r   p o d s   i n   t h e   G u a r a n t e e d   Q o S   c l a s s .   T h e   M e m o r y   M a n a g e r   e m p l o y s   h i n t   g e n e r a t i o n   p r o t o c o l   t o   y i e l d   t h e   m o s t   s u i t a b l e   N U M A   a f f i n i t y   f o r   a   p o d .   T h e   M e m o r y   M a n a g e r   f e e d s   t h e   c e n t r a l   m a n a g e r   ( T o p o l o g y   M a n a g e r )   w i t h   t h e s e   a f f i n i t y   h i n t s .   B a s e d   o n   b o t h   t h e   h i n t s   a n d   T o p o l o g y   M a n a g e r   p o l i c y ,   t h e   p o d   i s   r e j e c t e d   o r   a d m i t t e d   t o   t h e   n o d e .   M o r e o v e r ,   t h e   M e m o r y   M a n a g e r   e n s u r e s   t h a t   t h e   m e m o r y   w h i c h   a   p o d   r e q u e s t s   i s   a l l o c a t e d   f r o m   a   m i n i m u m   n u m b e r   o f   N U M A   n o d e s .   T h e   M e m o r y   M a n a g e r   i s   o n l y   p e r t i n e n t   t o   L i n u x   b a s e d   h o s t s .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 3 2 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is How does the Memory Manager Operate??

Answer: T h e   M e m o r y   M a n a g e r   c u r r e n t l y   o f f e r s   t h e   g u a r a n t e e d   m e m o r y   ( a n d   h u g e p a g e s )   a l l o c a t i o n   f o r   P o d s   i n   G u a r a n t e e d   Q o S   c l a s s .   T o   i m m e d i a t e l y   p u t   t h e   M e m o r y   M a n a g e r   i n t o   o p e r a t i o n   f o l l o w   t h e   g u i d e l i n e s   i n   t h e   s e c t i o n   M e m o r y   M a n a g e r   c o n f i g u r a t i o n ,   a n d   s u b s e q u e n t l y ,   p r e p a r e   a n d   d e p l o y   a   G u a r a n t e e d   p o d   a s   i l l u s t r a t e d   i n   t h e   s e c t i o n   P l a c i n g   a   P o d   i n   t h e   G u a r a n t e e d   Q o S   c l a s s .   T h e   M e m o r y   M a n a g e r   i s   a   H i n t   P r o v i d e r ,   a n d   i t   p r o v i d e s   t o p o l o g y   h i n t s   f o r   t h e   T o p o l o g y   M a n a g e r   w h i c h   t h e n   a l i g n s   t h e   r e q u e s t e d   r e s o u r c e s   a c c o r d i n g   t o   t h e s e   t o p o l o g y   h i n t s .   O n   L i n u x ,   i t   a l s o   e n f o r c e s   c g r o u p s   ( i . e .   c p u s e t . m e m s )   f o r   p o d s .   T h e   c o m p l e t e   f l o w   d i a g r a m   c o n c e r n i n g   p o d   a d m i s s i o n   a n d   d e p l o y m e n t   p r o c e s s   i s   i l l u s t r a t e d   i n   M e m o r y   M a n a g e r   K E P :   D e s i g n   O v e r v i e w   a n d   b e l o w :   D u r i n g   t h i s   p r o c e s s ,   t h e   M e m o r y   M a n a g e r   u p d a t e s   i t s   i n t e r n a l   c o u n t e r s   s t o r e d   i n   N o d e   M a p   a n d   M e m o r y   M a p s   t o   m a n a g e   g u a r a n t e e d   m e m o r y   a l l o c a t i o n .   T h e   M e m o r y   M a n a g e r   u p d a t e s   t h e   N o d e   M a p   d u r i n g   t h e   s t a r t u p   a n d   r u n t i m e   a s   f o l l o w s .


Question: What is Startup?

Answer: T h i s   o c c u r s   o n c e   a   n o d e   a d m i n i s t r a t o r   e m p l o y s   - - r e s e r v e d - m e m o r y   ( s e c t i o n   R e s e r v e d   m e m o r y   f l a g ) .   I n   t h i s   c a s e ,   t h e   N o d e   M a p   b e c o m e s   u p d a t e d   t o   r e f l e c t   t h i s   r e s e r v a t i o n   a s   i l l u s t r a t e d   i n   M e m o r y   M a n a g e r   K E P :   M e m o r y   M a p s   a t   s t a r t - u p   ( w i t h   e x a m p l e s ) .   T h e   a d m i n i s t r a t o r   m u s t   p r o v i d e   - - r e s e r v e d - m e m o r y   f l a g   w h e n   S t a t i c   p o l i c y   i s   c o n f i g u r e d .


Question: What is Runtime?

Answer: R e f e r e n c e   M e m o r y   M a n a g e r   K E P :   M e m o r y   M a p s   a t   r u n t i m e   ( w i t h   e x a m p l e s )   i l l u s t r a t e s   h o w   a   s u c c e s s f u l   p o d   d e p l o y m e n t   a f f e c t s   t h e   N o d e   M a p ,   a n d   i t   a l s o   r e l a t e s   t o   h o w   p o t e n t i a l   O u t - o f - M e m o r y   ( O O M )   s i t u a t i o n s   a r e   h a n d l e d   f u r t h e r   b y   K u b e r n e t e s   o r   o p e r a t i n g   s y s t e m .   I m p o r t a n t   t o p i c   i n   t h e   c o n t e x t   o f   M e m o r y   M a n a g e r   o p e r a t i o n   i s   t h e   m a n a g e m e n t   o f   N U M A   g r o u p s .   E a c h   t i m e   p o d ' s   m e m o r y   r e q u e s t   i s   i n   e x c e s s   o f   s i n g l e   N U M A   n o d e   c a p a c i t y ,   t h e   M e m o r y   M a n a g e r   a t t e m p t s   t o   c r e a t e   a   g r o u p   t h a t   c o m p r i s e s   s e v e r a l   N U M A   n o d e s   a n d   f e a t u r e s   e x t e n d   m e m o r y   c a p a c i t y .   T h e   p r o b l e m   h a s   b e e n   s o l v e d   a s   e l a b o r a t e d   i n   M e m o r y   M a n a g e r   K E P :   H o w   t o   e n a b l e   t h e   g u a r a n t e e d   m e m o r y   a l l o c a t i o n   o v e r   m a n y   N U M A   n o d e s ? .   A l s o ,   r e f e r e n c e   M e m o r y   M a n a g e r   K E P :   S i m u l a t i o n   -   h o w   t h e   M e m o r y   M a n a g e r   w o r k s ?   ( b y   e x a m p l e s )   i l l u s t r a t e s   h o w   t h e   m a n a g e m e n t   o f   g r o u p s   o c c u r s .


Question: What is Windows Support?

Answer: W i n d o w s   s u p p o r t   c a n   b e   e n a b l e d   v i a   t h e   W i n d o w s C P U A n d M e m o r y A f f i n i t y   f e a t u r e   g a t e   a n d   i t   r e q u i r e s   s u p p o r t   i n   t h e   c o n t a i n e r   r u n t i m e .   O n l y   t h e   B e s t E f f o r t   P o l i c y   i s   s u p p o r t e d   o n   W i n d o w s .


Question: What is Memory Manager configuration?

Answer: O t h e r   M a n a g e r s   s h o u l d   b e   f i r s t   p r e - c o n f i g u r e d .   N e x t ,   t h e   M e m o r y   M a n a g e r   f e a t u r e   s h o u l d   b e   e n a b l e d   a n d   b e   r u n   w i t h   S t a t i c   p o l i c y   ( s e c t i o n   S t a t i c   p o l i c y ) .   O p t i o n a l l y ,   s o m e   a m o u n t   o f   m e m o r y   c a n   b e   r e s e r v e d   f o r   s y s t e m   o r   k u b e l e t   p r o c e s s e s   t o   i n c r e a s e   n o d e   s t a b i l i t y   ( s e c t i o n   R e s e r v e d   m e m o r y   f l a g ) .


Question: What is Policies?

Answer: M e m o r y   M a n a g e r   s u p p o r t s   t w o   p o l i c i e s .   Y o u   c a n   s e l e c t   a   p o l i c y   v i a   a   k u b e l e t   f l a g   - - m e m o r y - m a n a g e r - p o l i c y :   N o n e   ( d e f a u l t ) S t a t i c   ( L i n u x   o n l y ) B e s t E f f o r t   ( W i n d o w s   O n l y )


Question: What is None policy?

Answer: T h i s   i s   t h e   d e f a u l t   p o l i c y   a n d   d o e s   n o t   a f f e c t   t h e   m e m o r y   a l l o c a t i o n   i n   a n y   w a y .   I t   a c t s   t h e   s a m e   a s   i f   t h e   M e m o r y   M a n a g e r   i s   n o t   p r e s e n t   a t   a l l .   T h e   N o n e   p o l i c y   r e t u r n s   d e f a u l t   t o p o l o g y   h i n t .   T h i s   s p e c i a l   h i n t   d e n o t e s   t h a t   H i n t   P r o v i d e r   ( M e m o r y   M a n a g e r   i n   t h i s   c a s e )   h a s   n o   p r e f e r e n c e   f o r   N U M A   a f f i n i t y   w i t h   a n y   r e s o u r c e .


Question: What is Static policy?

Answer: I n   t h e   c a s e   o f   t h e   G u a r a n t e e d   p o d ,   t h e   S t a t i c   M e m o r y   M a n a g e r   p o l i c y   r e t u r n s   t o p o l o g y   h i n t s   r e l a t i n g   t o   t h e   s e t   o f   N U M A   n o d e s   w h e r e   t h e   m e m o r y   c a n   b e   g u a r a n t e e d ,   a n d   r e s e r v e s   t h e   m e m o r y   t h r o u g h   u p d a t i n g   t h e   i n t e r n a l   N o d e M a p   o b j e c t .   I n   t h e   c a s e   o f   t h e   B e s t E f f o r t   o r   B u r s t a b l e   p o d ,   t h e   S t a t i c   M e m o r y   M a n a g e r   p o l i c y   s e n d s   b a c k   t h e   d e f a u l t   t o p o l o g y   h i n t   a s   t h e r e   i s   n o   r e q u e s t   f o r   t h e   g u a r a n t e e d   m e m o r y ,   a n d   d o e s   n o t   r e s e r v e   t h e   m e m o r y   i n   t h e   i n t e r n a l   N o d e M a p   o b j e c t .   T h i s   p o l i c y   i s   o n l y   s u p p o r t e d   o n   L i n u x .


Question: What is BestEffort policy?

Answer: T h i s   p o l i c y   i s   o n l y   s u p p o r t e d   o n   W i n d o w s .   O n   W i n d o w s ,   N U M A   n o d e   a s s i g n m e n t   w o r k s   d i f f e r e n t l y   t h a n   L i n u x .   T h e r e   i s   n o   m e c h a n i s m   t o   e n s u r e   t h a t   M e m o r y   a c c e s s   o n l y   c o m e s   f r o m   a   s p e c i f i c   N U M A   n o d e .   I n s t e a d   t h e   W i n d o w s   s c h e d u l e r   w i l l   s e l e c t   t h e   m o s t   o p t i m a l   N U M A   n o d e   b a s e d   o n   t h e   C P U ( s )   a s s i g n m e n t s .   I t   i s   p o s s i b l e   t h a t   W i n d o w s   m i g h t   u s e   o t h e r   N U M A   n o d e s   i f   d e e m e d   o p t i m a l   b y   t h e   W i n d o w s   s c h e d u l e r .   T h e   p o l i c y   d o e s   t r a c k   t h e   a m o u n t   o f   m e m o r y   a v a i l a b l e   a n d   r e q u e s t e d   t h r o u g h   t h e   i n t e r n a l   N o d e M a p .   T h e   m e m o r y   m a n a g e r   w i l l   m a k e   a   b e s t   e f f o r t   a t   e n s u r i n g   t h a t   e n o u g h   m e m o r y   i s   a v a i l a b l e   o n   a   N U M A   n o d e   b e f o r e   m a k i n g   t h e   a s s i g n m e n t . T h i s   m e a n s   t h a t   i n   m o s t   c a s e s   m e m o r y   a s s i g n m e n t   s h o u l d   f u n c t i o n   a s   e x p e c t e d .


Question: What is Reserved memory flag?

Answer: T h e   N o d e   A l l o c a t a b l e   m e c h a n i s m   i s   c o m m o n l y   u s e d   b y   n o d e   a d m i n i s t r a t o r s   t o   r e s e r v e   K 8 S   n o d e   s y s t e m   r e s o u r c e s   f o r   t h e   k u b e l e t   o r   o p e r a t i n g   s y s t e m   p r o c e s s e s   i n   o r d e r   t o   e n h a n c e   t h e   n o d e   s t a b i l i t y .   A   d e d i c a t e d   s e t   o f   f l a g s   c a n   b e   u s e d   f o r   t h i s   p u r p o s e   t o   s e t   t h e   t o t a l   a m o u n t   o f   r e s e r v e d   m e m o r y   f o r   a   n o d e .   T h i s   p r e - c o n f i g u r e d   v a l u e   i s   s u b s e q u e n t l y   u t i l i z e d   t o   c a l c u l a t e   t h e   r e a l   a m o u n t   o f   n o d e ' s   " a l l o c a t a b l e "   m e m o r y   a v a i l a b l e   t o   p o d s .   T h e   K u b e r n e t e s   s c h e d u l e r   i n c o r p o r a t e s   " a l l o c a t a b l e "   t o   o p t i m i s e   p o d   s c h e d u l i n g   p r o c e s s .   T h e   f o r e g o i n g   f l a g s   i n c l u d e   - - k u b e - r e s e r v e d ,   - - s y s t e m - r e s e r v e d   a n d   - - e v i c t i o n - t h r e s h o l d .   T h e   s u m   o f   t h e i r   v a l u e s   w i l l   a c c o u n t   f o r   t h e   t o t a l   a m o u n t   o f   r e s e r v e d   m e m o r y .   A   n e w   - - r e s e r v e d - m e m o r y   f l a g   w a s   a d d e d   t o   M e m o r y   M a n a g e r   t o   a l l o w   f o r   t h i s   t o t a l   r e s e r v e d   m e m o r y   t o   b e   s p l i t   ( b y   a   n o d e   a d m i n i s t r a t o r )   a n d   a c c o r d i n g l y   r e s e r v e d   a c r o s s   m a n y   N U M A   n o d e s .   T h e   f l a g   s p e c i f i e s   a   c o m m a - s e p a r a t e d   l i s t   o f   m e m o r y   r e s e r v a t i o n s   o f   d i f f e r e n t   m e m o r y   t y p e s   p e r   N U M A   n o d e .   M e m o r y   r e s e r v a t i o n s   a c


Question: What is Note:?

Answer: H e r e   i s   a n   e x a m p l e   o f   a   c o r r e c t   c o n f i g u r a t i o n :   - - k u b e - r e s e r v e d = c p u = 4 , m e m o r y = 4 G i   - - s y s t e m - r e s e r v e d = c p u = 1 , m e m o r y = 1 G i   - - m e m o r y - m a n a g e r - p o l i c y = S t a t i c   - - r e s e r v e d - m e m o r y   ' 0 : m e m o r y = 3 G i ; 1 : m e m o r y = 2 1 4 8 M i '   P r i o r   t o   K u b e r n e t e s   1 . 3 2 ,   y o u   a l s o   n e e d   t o   a d d   - - f e a t u r e - g a t e s = M e m o r y M a n a g e r = t r u e   L e t   u s   v a l i d a t e   t h e   c o n f i g u r a t i o n   a b o v e :   k u b e - r e s e r v e d   +   s y s t e m - r e s e r v e d   +   e v i c t i o n - h a r d ( d e f a u l t )   =   r e s e r v e d - m e m o r y ( 0 )   +   r e s e r v e d - m e m o r y ( 1 ) 4 G i B   +   1 G i B   +   1 0 0 M i B   =   3 G i B   +   2 1 4 8 M i B 5 1 2 0 M i B   +   1 0 0 M i B   =   3 0 7 2 M i B   +   2 1 4 8 M i B 5 2 2 0 M i B   =   5 2 2 0 M i B   ( w h i c h   i s   c o r r e c t )


Question: What is Placing a Pod in the Guaranteed QoS class?

Answer: I f   t h e   s e l e c t e d   p o l i c y   i s   a n y t h i n g   o t h e r   t h a n   N o n e ,   t h e   M e m o r y   M a n a g e r   i d e n t i f i e s   p o d s   t h a t   a r e   i n   t h e   G u a r a n t e e d   Q o S   c l a s s .   T h e   M e m o r y   M a n a g e r   p r o v i d e s   s p e c i f i c   t o p o l o g y   h i n t s   t o   t h e   T o p o l o g y   M a n a g e r   f o r   e a c h   G u a r a n t e e d   p o d .   F o r   p o d s   i n   a   Q o S   c l a s s   o t h e r   t h a n   G u a r a n t e e d ,   t h e   M e m o r y   M a n a g e r   p r o v i d e s   d e f a u l t   t o p o l o g y   h i n t s   t o   t h e   T o p o l o g y   M a n a g e r .   T h e   f o l l o w i n g   e x c e r p t s   f r o m   p o d   m a n i f e s t s   a s s i g n   a   p o d   t o   t h e   G u a r a n t e e d   Q o S   c l a s s .   P o d   w i t h   i n t e g e r   C P U ( s )   r u n s   i n   t h e   G u a r a n t e e d   Q o S   c l a s s ,   w h e n   r e q u e s t s   a r e   e q u a l   t o   l i m i t s :   s p e c :   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   r e s o u r c e s :   l i m i t s :   m e m o r y :   " 2 0 0 M i "   c p u :   " 2 "   e x a m p l e . c o m / d e v i c e :   " 1 "   r e q u e s t s :   m e m o r y :   " 2 0 0 M i "   c p u :   " 2 "   e x a m p l e . c o m / d e v i c e :   " 1 "   A l s o ,   a   p o d   s h a r i n g   C P U ( s )   r u n s   i n   t h e   G u a r a n t e e d   Q o S   c l a s s ,   w h e n   r e q u e s t s   a r e   e q u a l   t o   l i m i t s .   s p e c :   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   r e s o u r c e s :   l i m i t s :   m e m o r y :   " 2 0 0 M i "   c p u :   " 3 0 0 m "   e x a m p l e . c o m / d e v i c e :   " 1 "   r e q u e s t s :   m e m o r y :   " 2 0 0 M i "   c p u :   " 3 0 0 m "   e x a m p l e . c o m / d e v i c e :   " 1 "   N o t i c e   t h a t   b o t h   C P U   a n d   m e m


Question: What is Troubleshooting?

Answer: T h e   f o l l o w i n g   m e a n s   c a n   b e   u s e d   t o   t r o u b l e s h o o t   t h e   r e a s o n   w h y   a   p o d   c o u l d   n o t   b e   d e p l o y e d   o r   b e c a m e   r e j e c t e d   a t   a   n o d e :   p o d   s t a t u s   -   i n d i c a t e s   t o p o l o g y   a f f i n i t y   e r r o r s s y s t e m   l o g s   -   i n c l u d e   v a l u a b l e   i n f o r m a t i o n   f o r   d e b u g g i n g ,   e . g . ,   a b o u t   g e n e r a t e d   h i n t s s t a t e   f i l e   -   t h e   d u m p   o f   i n t e r n a l   s t a t e   o f   t h e   M e m o r y   M a n a g e r   ( i n c l u d e s   N o d e   M a p   a n d   M e m o r y   M a p s ) s t a r t i n g   f r o m   v 1 . 2 2 ,   t h e   d e v i c e   p l u g i n   r e s o u r c e   A P I   c a n   b e   u s e d   t o   r e t r i e v e   i n f o r m a t i o n   a b o u t   t h e   m e m o r y   r e s e r v e d   f o r   c o n t a i n e r s