Question: What are the benefits of Kubernetes Security and Disclosure Information?

Answer: Kubernetes Security and Disclosure InformationThis page describes Kubernetes security and disclosure information.Security AnnouncementsJoin the kubernetes-security-announce group for emails about security and major API announcements.Report a VulnerabilityWe're extremely grateful for security researchers and users that report vulnerabilities to the Kubernetes Open Source Community. All reports are thoroughly investigated by a set of community volunteers.To make a report, submit your vulnerability to the Kubernetes bug bounty program. This allows triage and handling of the vulnerability with standardized response times.You can also email the private security@kubernetes.io list with the security details and the details expected for all Kubernetes bug reports.You may encrypt your email to this list using the GPG keys of the Security Response Committee members. Encryption using GPG is NOT required to make a disclosure.When Should I Report a Vulnerability?You think you discovered a potential security vulnerability in KubernetesYou are unsure how a vulnerability affects KubernetesYou think you discovered a vulnerability in another project that Kubernetes depends onFor projects with their own vulnerability reporting and disclosure process, please report it directly thereWhen Should I NOT Report a Vulnerability?You need help tuning Kubernetes components for securityYou need help applying security related updatesYour issue is not security relatedSecurity Vulnerability ResponseEach report is acknowledged and analyzed by Security Response Committee members within 3 working days. This will set off the Security Release Process.Any vulnerability information shared with Security Response Committee stays within Kubernetes project and will not be disseminated to other projects unless it is necessary to get the issue fixed.As the security issue moves from triage, to identified fix, to release planning we will keep the reporter updated.Public Disclosure TimingA public disclosure date is negotiated by the Kubernetes Security Response Committee and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to a few weeks. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days. The Kubernetes Security Response Committee holds the final say when setting a disclosure date.


Question: What is Kubernetes Security and Disclosure Information?

Answer: T h i s   p a g e   d e s c r i b e s   K u b e r n e t e s   s e c u r i t y   a n d   d i s c l o s u r e   i n f o r m a t i o n .


Question: What is Security Announcements?

Answer: J o i n   t h e   k u b e r n e t e s - s e c u r i t y - a n n o u n c e   g r o u p   f o r   e m a i l s   a b o u t   s e c u r i t y   a n d   m a j o r   A P I   a n n o u n c e m e n t s .


Question: What is Report a Vulnerability?

Answer: W e ' r e   e x t r e m e l y   g r a t e f u l   f o r   s e c u r i t y   r e s e a r c h e r s   a n d   u s e r s   t h a t   r e p o r t   v u l n e r a b i l i t i e s   t o   t h e   K u b e r n e t e s   O p e n   S o u r c e   C o m m u n i t y .   A l l   r e p o r t s   a r e   t h o r o u g h l y   i n v e s t i g a t e d   b y   a   s e t   o f   c o m m u n i t y   v o l u n t e e r s .   T o   m a k e   a   r e p o r t ,   s u b m i t   y o u r   v u l n e r a b i l i t y   t o   t h e   K u b e r n e t e s   b u g   b o u n t y   p r o g r a m .   T h i s   a l l o w s   t r i a g e   a n d   h a n d l i n g   o f   t h e   v u l n e r a b i l i t y   w i t h   s t a n d a r d i z e d   r e s p o n s e   t i m e s .   Y o u   c a n   a l s o   e m a i l   t h e   p r i v a t e   s e c u r i t y @ k u b e r n e t e s . i o   l i s t   w i t h   t h e   s e c u r i t y   d e t a i l s   a n d   t h e   d e t a i l s   e x p e c t e d   f o r   a l l   K u b e r n e t e s   b u g   r e p o r t s .   Y o u   m a y   e n c r y p t   y o u r   e m a i l   t o   t h i s   l i s t   u s i n g   t h e   G P G   k e y s   o f   t h e   S e c u r i t y   R e s p o n s e   C o m m i t t e e   m e m b e r s .   E n c r y p t i o n   u s i n g   G P G   i s   N O T   r e q u i r e d   t o   m a k e   a   d i s c l o s u r e .


Question: What is When Should I Report a Vulnerability??

Answer: Y o u   t h i n k   y o u   d i s c o v e r e d   a   p o t e n t i a l   s e c u r i t y   v u l n e r a b i l i t y   i n   K u b e r n e t e s Y o u   a r e   u n s u r e   h o w   a   v u l n e r a b i l i t y   a f f e c t s   K u b e r n e t e s Y o u   t h i n k   y o u   d i s c o v e r e d   a   v u l n e r a b i l i t y   i n   a n o t h e r   p r o j e c t   t h a t   K u b e r n e t e s   d e p e n d s   o n F o r   p r o j e c t s   w i t h   t h e i r   o w n   v u l n e r a b i l i t y   r e p o r t i n g   a n d   d i s c l o s u r e   p r o c e s s ,   p l e a s e   r e p o r t   i t   d i r e c t l y   t h e r e   F o r   p r o j e c t s   w i t h   t h e i r   o w n   v u l n e r a b i l i t y   r e p o r t i n g   a n d   d i s c l o s u r e   p r o c e s s ,   p l e a s e   r e p o r t   i t   d i r e c t l y   t h e r e


Question: What is When Should I NOT Report a Vulnerability??

Answer: Y o u   n e e d   h e l p   t u n i n g   K u b e r n e t e s   c o m p o n e n t s   f o r   s e c u r i t y Y o u   n e e d   h e l p   a p p l y i n g   s e c u r i t y   r e l a t e d   u p d a t e s Y o u r   i s s u e   i s   n o t   s e c u r i t y   r e l a t e d


Question: What is Security Vulnerability Response?

Answer: E a c h   r e p o r t   i s   a c k n o w l e d g e d   a n d   a n a l y z e d   b y   S e c u r i t y   R e s p o n s e   C o m m i t t e e   m e m b e r s   w i t h i n   3   w o r k i n g   d a y s .   T h i s   w i l l   s e t   o f f   t h e   S e c u r i t y   R e l e a s e   P r o c e s s .   A n y   v u l n e r a b i l i t y   i n f o r m a t i o n   s h a r e d   w i t h   S e c u r i t y   R e s p o n s e   C o m m i t t e e   s t a y s   w i t h i n   K u b e r n e t e s   p r o j e c t   a n d   w i l l   n o t   b e   d i s s e m i n a t e d   t o   o t h e r   p r o j e c t s   u n l e s s   i t   i s   n e c e s s a r y   t o   g e t   t h e   i s s u e   f i x e d .   A s   t h e   s e c u r i t y   i s s u e   m o v e s   f r o m   t r i a g e ,   t o   i d e n t i f i e d   f i x ,   t o   r e l e a s e   p l a n n i n g   w e   w i l l   k e e p   t h e   r e p o r t e r   u p d a t e d .


Question: What is Public Disclosure Timing?

Answer: A   p u b l i c   d i s c l o s u r e   d a t e   i s   n e g o t i a t e d   b y   t h e   K u b e r n e t e s   S e c u r i t y   R e s p o n s e   C o m m i t t e e   a n d   t h e   b u g   s u b m i t t e r .   W e   p r e f e r   t o   f u l l y   d i s c l o s e   t h e   b u g   a s   s o o n   a s   p o s s i b l e   o n c e   a   u s e r   m i t i g a t i o n   i s   a v a i l a b l e .   I t   i s   r e a s o n a b l e   t o   d e l a y   d i s c l o s u r e   w h e n   t h e   b u g   o r   t h e   f i x   i s   n o t   y e t   f u l l y   u n d e r s t o o d ,   t h e   s o l u t i o n   i s   n o t   w e l l - t e s t e d ,   o r   f o r   v e n d o r   c o o r d i n a t i o n .   T h e   t i m e f r a m e   f o r   d i s c l o s u r e   i s   f r o m   i m m e d i a t e   ( e s p e c i a l l y   i f   i t ' s   a l r e a d y   p u b l i c l y   k n o w n )   t o   a   f e w   w e e k s .   F o r   a   v u l n e r a b i l i t y   w i t h   a   s t r a i g h t f o r w a r d   m i t i g a t i o n ,   w e   e x p e c t   r e p o r t   d a t e   t o   d i s c l o s u r e   d a t e   t o   b e   o n   t h e   o r d e r   o f   7   d a y s .   T h e   K u b e r n e t e s   S e c u r i t y   R e s p o n s e   C o m m i t t e e   h o l d s   t h e   f i n a l   s a y   w h e n   s e t t i n g   a   d i s c l o s u r e   d a t e .


Question: What is Dynamic Resource Allocation?

Answer: Dynamic Resource AllocationFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page describes dynamic resource allocation (DRA) in Kubernetes.About DRADRA is a Kubernetes feature that lets you request and share resources among Pods. These resources are often attached devices like hardware accelerators.With DRA, device drivers and cluster admins define device classes that are available to claim in workloads. Kubernetes allocates matching devices to specific claims and places the corresponding Pods on nodes that can access the allocated devices.Allocating resources with DRA is a similar experience to dynamic volume provisioning, in which you use PersistentVolumeClaims to claim storage capacity from storage classes and request the claimed capacity in your Pods.Benefits of DRADRA provides a flexible way to categorize, request, and use devices in your cluster. Using DRA provides benefits like the following:Flexible device filtering: use common expression language (CEL) to perform fine-grained filtering for specific device attributes.Device sharing: share the same resource with multiple containers or Pods by referencing the corresponding resource claim.Centralized device categorization: device drivers and cluster admins can use device classes to provide app operators with hardware categories that are optimized for various use cases. For example, you can create a cost-optimized device class for general-purpose workloads, and a high-performance device class for critical jobs.Simplified Pod requests: with DRA, app operators don't need to specify device quantities in Pod resource requests. Instead, the Pod references a resource claim, and the device configuration in that claim applies to the Pod.These benefits provide significant improvements in the device allocation workflow when compared to device plugins, which require per-container device requests, don't support device sharing, and don't support expression-based device filtering.Types of DRA usersThe workflow of using DRA to allocate devices involves the following types of users:Device owner: responsible for devices. Device owners might be commercial vendors, the cluster operator, or another entity. To use DRA, devices must have DRA-compatible drivers that do the following:Create ResourceSlices that provide Kubernetes with information about nodes and resources.Update ResourceSlices when resource capacity in the cluster changes.Optionally, create DeviceClasses that workload operators can use to claim devices.Cluster admin: responsible for configuring clusters and nodes, attaching devices, installing drivers, and similar tasks. To use DRA, cluster admins do the following:Attach devices to nodes.Install device drivers that support DRA.Optionally, create DeviceClasses that workload operators can use to claim devices.Workload operator: responsible for deploying and managing workloads in the cluster. To use DRA to allocate devices to Pods, workload operators do the following:Create Resour


Question: How does Dynamic Resource Allocation work?

Answer: Dynamic Resource AllocationFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page describes dynamic resource allocation (DRA) in Kubernetes.About DRADRA is a Kubernetes feature that lets you request and share resources among Pods. These resources are often attached devices like hardware accelerators.With DRA, device drivers and cluster admins define device classes that are available to claim in workloads. Kubernetes allocates matching devices to specific claims and places the corresponding Pods on nodes that can access the allocated devices.Allocating resources with DRA is a similar experience to dynamic volume provisioning, in which you use PersistentVolumeClaims to claim storage capacity from storage classes and request the claimed capacity in your Pods.Benefits of DRADRA provides a flexible way to categorize, request, and use devices in your cluster. Using DRA provides benefits like the following:Flexible device filtering: use common expression language (CEL) to perform fine-grained filtering for specific device attributes.Device sharing: share the same resource with multiple containers or Pods by referencing the corresponding resource claim.Centralized device categorization: device drivers and cluster admins can use device classes to provide app operators with hardware categories that are optimized for various use cases. For example, you can create a cost-optimized device class for general-purpose workloads, and a high-performance device class for critical jobs.Simplified Pod requests: with DRA, app operators don't need to specify device quantities in Pod resource requests. Instead, the Pod references a resource claim, and the device configuration in that claim applies to the Pod.These benefits provide significant improvements in the device allocation workflow when compared to device plugins, which require per-container device requests, don't support device sharing, and don't support expression-based device filtering.Types of DRA usersThe workflow of using DRA to allocate devices involves the following types of users:Device owner: responsible for devices. Device owners might be commercial vendors, the cluster operator, or another entity. To use DRA, devices must have DRA-compatible drivers that do the following:Create ResourceSlices that provide Kubernetes with information about nodes and resources.Update ResourceSlices when resource capacity in the cluster changes.Optionally, create DeviceClasses that workload operators can use to claim devices.Cluster admin: responsible for configuring clusters and nodes, attaching devices, installing drivers, and similar tasks. To use DRA, cluster admins do the following:Attach devices to nodes.Install device drivers that support DRA.Optionally, create DeviceClasses that workload operators can use to claim devices.Workload operator: responsible for deploying and managing workloads in the cluster. To use DRA to allocate devices to Pods, workload operators do the following:Create Resour


Question: When would you use Dynamic Resource Allocation?

Answer: Dynamic Resource AllocationFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page describes dynamic resource allocation (DRA) in Kubernetes.About DRADRA is a Kubernetes feature that lets you request and share resources among Pods. These resources are often attached devices like hardware accelerators.With DRA, device drivers and cluster admins define device classes that are available to claim in workloads. Kubernetes allocates matching devices to specific claims and places the corresponding Pods on nodes that can access the allocated devices.Allocating resources with DRA is a similar experience to dynamic volume provisioning, in which you use PersistentVolumeClaims to claim storage capacity from storage classes and request the claimed capacity in your Pods.Benefits of DRADRA provides a flexible way to categorize, request, and use devices in your cluster. Using DRA provides benefits like the following:Flexible device filtering: use common expression language (CEL) to perform fine-grained filtering for specific device attributes.Device sharing: share the same resource with multiple containers or Pods by referencing the corresponding resource claim.Centralized device categorization: device drivers and cluster admins can use device classes to provide app operators with hardware categories that are optimized for various use cases. For example, you can create a cost-optimized device class for general-purpose workloads, and a high-performance device class for critical jobs.Simplified Pod requests: with DRA, app operators don't need to specify device quantities in Pod resource requests. Instead, the Pod references a resource claim, and the device configuration in that claim applies to the Pod.These benefits provide significant improvements in the device allocation workflow when compared to device plugins, which require per-container device requests, don't support device sharing, and don't support expression-based device filtering.Types of DRA usersThe workflow of using DRA to allocate devices involves the following types of users:Device owner: responsible for devices. Device owners might be commercial vendors, the cluster operator, or another entity. To use DRA, devices must have DRA-compatible drivers that do the following:Create ResourceSlices that provide Kubernetes with information about nodes and resources.Update ResourceSlices when resource capacity in the cluster changes.Optionally, create DeviceClasses that workload operators can use to claim devices.Cluster admin: responsible for configuring clusters and nodes, attaching devices, installing drivers, and similar tasks. To use DRA, cluster admins do the following:Attach devices to nodes.Install device drivers that support DRA.Optionally, create DeviceClasses that workload operators can use to claim devices.Workload operator: responsible for deploying and managing workloads in the cluster. To use DRA to allocate devices to Pods, workload operators do the following:Create Resour


Question: What are the benefits of Dynamic Resource Allocation?

Answer: Dynamic Resource AllocationFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page describes dynamic resource allocation (DRA) in Kubernetes.About DRADRA is a Kubernetes feature that lets you request and share resources among Pods. These resources are often attached devices like hardware accelerators.With DRA, device drivers and cluster admins define device classes that are available to claim in workloads. Kubernetes allocates matching devices to specific claims and places the corresponding Pods on nodes that can access the allocated devices.Allocating resources with DRA is a similar experience to dynamic volume provisioning, in which you use PersistentVolumeClaims to claim storage capacity from storage classes and request the claimed capacity in your Pods.Benefits of DRADRA provides a flexible way to categorize, request, and use devices in your cluster. Using DRA provides benefits like the following:Flexible device filtering: use common expression language (CEL) to perform fine-grained filtering for specific device attributes.Device sharing: share the same resource with multiple containers or Pods by referencing the corresponding resource claim.Centralized device categorization: device drivers and cluster admins can use device classes to provide app operators with hardware categories that are optimized for various use cases. For example, you can create a cost-optimized device class for general-purpose workloads, and a high-performance device class for critical jobs.Simplified Pod requests: with DRA, app operators don't need to specify device quantities in Pod resource requests. Instead, the Pod references a resource claim, and the device configuration in that claim applies to the Pod.These benefits provide significant improvements in the device allocation workflow when compared to device plugins, which require per-container device requests, don't support device sharing, and don't support expression-based device filtering.Types of DRA usersThe workflow of using DRA to allocate devices involves the following types of users:Device owner: responsible for devices. Device owners might be commercial vendors, the cluster operator, or another entity. To use DRA, devices must have DRA-compatible drivers that do the following:Create ResourceSlices that provide Kubernetes with information about nodes and resources.Update ResourceSlices when resource capacity in the cluster changes.Optionally, create DeviceClasses that workload operators can use to claim devices.Cluster admin: responsible for configuring clusters and nodes, attaching devices, installing drivers, and similar tasks. To use DRA, cluster admins do the following:Attach devices to nodes.Install device drivers that support DRA.Optionally, create DeviceClasses that workload operators can use to claim devices.Workload operator: responsible for deploying and managing workloads in the cluster. To use DRA to allocate devices to Pods, workload operators do the following:Create Resour


Question: What is Dynamic Resource Allocation?

Answer: T h i s   p a g e   d e s c r i b e s   d y n a m i c   r e s o u r c e   a l l o c a t i o n   ( D R A )   i n   K u b e r n e t e s .


Question: What is About DRA?

Answer: D R A   i s   a   K u b e r n e t e s   f e a t u r e   t h a t   l e t s   y o u   r e q u e s t   a n d   s h a r e   r e s o u r c e s   a m o n g   P o d s .   T h e s e   r e s o u r c e s   a r e   o f t e n   a t t a c h e d   d e v i c e s   l i k e   h a r d w a r e   a c c e l e r a t o r s .   D R A   i s   a   K u b e r n e t e s   f e a t u r e   t h a t   l e t s   y o u   r e q u e s t   a n d   s h a r e   r e s o u r c e s   a m o n g   P o d s .   T h e s e   r e s o u r c e s   a r e   o f t e n   a t t a c h e d   d e v i c e s   l i k e   h a r d w a r e   a c c e l e r a t o r s .   W i t h   D R A ,   d e v i c e   d r i v e r s   a n d   c l u s t e r   a d m i n s   d e f i n e   d e v i c e   c l a s s e s   t h a t   a r e   a v a i l a b l e   t o   c l a i m   i n   w o r k l o a d s .   K u b e r n e t e s   a l l o c a t e s   m a t c h i n g   d e v i c e s   t o   s p e c i f i c   c l a i m s   a n d   p l a c e s   t h e   c o r r e s p o n d i n g   P o d s   o n   n o d e s   t h a t   c a n   a c c e s s   t h e   a l l o c a t e d   d e v i c e s .   A l l o c a t i n g   r e s o u r c e s   w i t h   D R A   i s   a   s i m i l a r   e x p e r i e n c e   t o   d y n a m i c   v o l u m e   p r o v i s i o n i n g ,   i n   w h i c h   y o u   u s e   P e r s i s t e n t V o l u m e C l a i m s   t o   c l a i m   s t o r a g e   c a p a c i t y   f r o m   s t o r a g e   c l a s s e s   a n d   r e q u e s t   t h e   c l a i m e d   c a p a c i t y   i n   y o u r   P o d s .


Question: What is Benefits of DRA?

Answer: D R A   p r o v i d e s   a   f l e x i b l e   w a y   t o   c a t e g o r i z e ,   r e q u e s t ,   a n d   u s e   d e v i c e s   i n   y o u r   c l u s t e r .   U s i n g   D R A   p r o v i d e s   b e n e f i t s   l i k e   t h e   f o l l o w i n g :   F l e x i b l e   d e v i c e   f i l t e r i n g :   u s e   c o m m o n   e x p r e s s i o n   l a n g u a g e   ( C E L )   t o   p e r f o r m   f i n e - g r a i n e d   f i l t e r i n g   f o r   s p e c i f i c   d e v i c e   a t t r i b u t e s . D e v i c e   s h a r i n g :   s h a r e   t h e   s a m e   r e s o u r c e   w i t h   m u l t i p l e   c o n t a i n e r s   o r   P o d s   b y   r e f e r e n c i n g   t h e   c o r r e s p o n d i n g   r e s o u r c e   c l a i m . C e n t r a l i z e d   d e v i c e   c a t e g o r i z a t i o n :   d e v i c e   d r i v e r s   a n d   c l u s t e r   a d m i n s   c a n   u s e   d e v i c e   c l a s s e s   t o   p r o v i d e   a p p   o p e r a t o r s   w i t h   h a r d w a r e   c a t e g o r i e s   t h a t   a r e   o p t i m i z e d   f o r   v a r i o u s   u s e   c a s e s .   F o r   e x a m p l e ,   y o u   c a n   c r e a t e   a   c o s t - o p t i m i z e d   d e v i c e   c l a s s   f o r   g e n e r a l - p u r p o s e   w o r k l o a d s ,   a n d   a   h i g h - p e r f o r m a n c e   d e v i c e   c l a s s   f o r   c r i t i c a l   j o b s . S i m p l i f i e d   P o d   r e q u e s t s :   w i t h   D R A ,   a p p   o p e r a t o r s   d o n ' t   n e e d   t o   s p e c i f y   d e v i c e   q u a n t i t i e s   i n   P o d   r e s o u r c e   r e q u e s t s .   I n s t e a d ,   t h e   P o d   r e f e r e n c e s   a   r e s o u r c e   c l a i m ,   a n d   t h e   d e v i c e   c o n f i g u r a t i o n   i n   t h a t   c l a i m   a p p l i e s   t o   t h e   P o d .   T h e s e   b e n e f i t s   p r o v i d e   s i g n i f i c a n t   i m p r o v e m e n t s   i n   t h e   d e v i c e   a l l o


Question: What is Types of DRA users?

Answer: T h e   w o r k f l o w   o f   u s i n g   D R A   t o   a l l o c a t e   d e v i c e s   i n v o l v e s   t h e   f o l l o w i n g   t y p e s   o f   u s e r s :   D e v i c e   o w n e r :   r e s p o n s i b l e   f o r   d e v i c e s .   D e v i c e   o w n e r s   m i g h t   b e   c o m m e r c i a l   v e n d o r s ,   t h e   c l u s t e r   o p e r a t o r ,   o r   a n o t h e r   e n t i t y .   T o   u s e   D R A ,   d e v i c e s   m u s t   h a v e   D R A - c o m p a t i b l e   d r i v e r s   t h a t   d o   t h e   f o l l o w i n g : C r e a t e   R e s o u r c e S l i c e s   t h a t   p r o v i d e   K u b e r n e t e s   w i t h   i n f o r m a t i o n   a b o u t   n o d e s   a n d   r e s o u r c e s . U p d a t e   R e s o u r c e S l i c e s   w h e n   r e s o u r c e   c a p a c i t y   i n   t h e   c l u s t e r   c h a n g e s . O p t i o n a l l y ,   c r e a t e   D e v i c e C l a s s e s   t h a t   w o r k l o a d   o p e r a t o r s   c a n   u s e   t o   c l a i m   d e v i c e s . C l u s t e r   a d m i n :   r e s p o n s i b l e   f o r   c o n f i g u r i n g   c l u s t e r s   a n d   n o d e s ,   a t t a c h i n g   d e v i c e s ,   i n s t a l l i n g   d r i v e r s ,   a n d   s i m i l a r   t a s k s .   T o   u s e   D R A ,   c l u s t e r   a d m i n s   d o   t h e   f o l l o w i n g : A t t a c h   d e v i c e s   t o   n o d e s . I n s t a l l   d e v i c e   d r i v e r s   t h a t   s u p p o r t   D R A . O p t i o n a l l y ,   c r e a t e   D e v i c e C l a s s e s   t h a t   w o r k l o a d   o p e r a t o r s   c a n   u s e   t o   c l a i m   d e v i c e s . W o r k l o a d   o p e r a t o r :   r e s p o n s i b l e   f o r   d e p l o y i n g   a n d   m a n a g i n g   w o r k l o a d s   i n   t h e   c l u s t e r .   T o   u s e   D R A   t o   a l l o c a t e   d e v i c e s   t o   P o d s ,   w o r k l o a d   o p e r a t o r s   d o   t h e   f o l l o w i n g : C r e a t e


Question: What is DRA terminology?

Answer: D R A   u s e s   t h e   f o l l o w i n g   K u b e r n e t e s   A P I   k i n d s   t o   p r o v i d e   t h e   c o r e   a l l o c a t i o n   f u n c t i o n a l i t y .   A l l   o f   t h e s e   A P I   k i n d s   a r e   i n c l u d e d   i n   t h e   r e s o u r c e . k 8 s . i o / v 1   A P I   g r o u p .


Question: What is DeviceClass?

Answer: A   D e v i c e C l a s s   l e t s   c l u s t e r   a d m i n s   o r   d e v i c e   d r i v e r s   d e f i n e   c a t e g o r i e s   o f   d e v i c e s   i n   t h e   c l u s t e r .   D e v i c e C l a s s e s   t e l l   o p e r a t o r s   w h a t   d e v i c e s   t h e y   c a n   r e q u e s t   a n d   h o w   t h e y   c a n   r e q u e s t   t h o s e   d e v i c e s .   Y o u   c a n   u s e   c o m m o n   e x p r e s s i o n   l a n g u a g e   ( C E L )   t o   s e l e c t   d e v i c e s   b a s e d   o n   s p e c i f i c   a t t r i b u t e s .   A   R e s o u r c e C l a i m   t h a t   r e f e r e n c e s   t h e   D e v i c e C l a s s   c a n   t h e n   r e q u e s t   s p e c i f i c   c o n f i g u r a t i o n s   w i t h i n   t h e   D e v i c e C l a s s .   T o   c r e a t e   a   D e v i c e C l a s s ,   s e e   S e t   U p   D R A   i n   a   C l u s t e r .


Question: What is ResourceClaims and ResourceClaimTemplates?

Answer: A   R e s o u r c e C l a i m   d e f i n e s   t h e   r e s o u r c e s   t h a t   a   w o r k l o a d   n e e d s .   E v e r y   R e s o u r c e C l a i m   h a s   r e q u e s t s   t h a t   r e f e r e n c e   a   D e v i c e C l a s s   a n d   s e l e c t   d e v i c e s   f r o m   t h a t   D e v i c e C l a s s .   R e s o u r c e C l a i m s   c a n   a l s o   u s e   s e l e c t o r s   t o   f i l t e r   f o r   d e v i c e s   t h a t   m e e t   s p e c i f i c   r e q u i r e m e n t s ,   a n d   c a n   u s e   c o n s t r a i n t s   t o   l i m i t   t h e   d e v i c e s   t h a t   c a n   s a t i s f y   a   r e q u e s t .   R e s o u r c e C l a i m s   c a n   b e   c r e a t e d   b y   w o r k l o a d   o p e r a t o r s   o r   c a n   b e   g e n e r a t e d   b y   K u b e r n e t e s   b a s e d   o n   a   R e s o u r c e C l a i m T e m p l a t e .   A   R e s o u r c e C l a i m T e m p l a t e   d e f i n e s   a   t e m p l a t e   t h a t   K u b e r n e t e s   c a n   u s e   t o   a u t o - g e n e r a t e   R e s o u r c e C l a i m s   f o r   P o d s .


Question: What is Use cases for ResourceClaims and ResourceClaimTemplates?

Answer: T h e   m e t h o d   t h a t   y o u   u s e   d e p e n d s   o n   y o u r   r e q u i r e m e n t s ,   a s   f o l l o w s :   R e s o u r c e C l a i m :   y o u   w a n t   m u l t i p l e   P o d s   t o   s h a r e   a c c e s s   t o   s p e c i f i c   d e v i c e s .   Y o u   m a n u a l l y   m a n a g e   t h e   l i f e c y c l e   o f   R e s o u r c e C l a i m s   t h a t   y o u   c r e a t e . R e s o u r c e C l a i m T e m p l a t e :   y o u   w a n t   P o d s   t o   h a v e   i n d e p e n d e n t   a c c e s s   t o   s e p a r a t e ,   s i m i l a r l y - c o n f i g u r e d   d e v i c e s .   K u b e r n e t e s   g e n e r a t e s   R e s o u r c e C l a i m s   f r o m   t h e   s p e c i f i c a t i o n   i n   t h e   R e s o u r c e C l a i m T e m p l a t e .   T h e   l i f e t i m e   o f   e a c h   g e n e r a t e d   R e s o u r c e C l a i m   i s   b o u n d   t o   t h e   l i f e t i m e   o f   t h e   c o r r e s p o n d i n g   P o d .   W h e n   y o u   d e f i n e   a   w o r k l o a d ,   y o u   c a n   u s e   C o m m o n   E x p r e s s i o n   L a n g u a g e   ( C E L )   t o   f i l t e r   f o r   s p e c i f i c   d e v i c e   a t t r i b u t e s   o r   c a p a c i t y .   T h e   a v a i l a b l e   p a r a m e t e r s   f o r   f i l t e r i n g   d e p e n d   o n   t h e   d e v i c e   a n d   t h e   d r i v e r s .   I f   y o u   d i r e c t l y   r e f e r e n c e   a   s p e c i f i c   R e s o u r c e C l a i m   i n   a   P o d ,   t h a t   R e s o u r c e C l a i m   m u s t   a l r e a d y   e x i s t   i n   t h e   s a m e   n a m e s p a c e   a s   t h e   P o d .   I f   t h e   R e s o u r c e C l a i m   d o e s n ' t   e x i s t   i n   t h e   n a m e s p a c e ,   t h e   P o d   w o n ' t   s c h e d u l e .   T h i s   b e h a v i o r   i s   s i m i l a r   t o   h o w   a   P e r s i s t e n t V o l u m e C l a i m   m u s t   e x i s t   i n   t h e   s a m e   n a m e s p


Question: What is Prioritized list?

Answer: Y o u   c a n   p r o v i d e   a   p r i o r i t i z e d   l i s t   o f   s u b r e q u e s t s   f o r   r e q u e s t s   i n   a   R e s o u r c e C l a i m   o r   R e s o u r c e C l a i m T e m p l a t e .   T h e   s c h e d u l e r   w i l l   t h e n   s e l e c t   t h e   f i r s t   s u b r e q u e s t   t h a t   c a n   b e   a l l o c a t e d .   T h i s   a l l o w s   u s e r s   t o   s p e c i f y   a l t e r n a t i v e   d e v i c e s   t h a t   c a n   b e   u s e d   b y   t h e   w o r k l o a d   i f   t h e   p r i m a r y   c h o i c e   i s   n o t   a v a i l a b l e .   I n   t h e   e x a m p l e   b e l o w ,   t h e   R e s o u r c e C l a i m T e m p l a t e   r e q u e s t e d   a   d e v i c e   w i t h   t h e   c o l o r   b l a c k   a n d   t h e   s i z e   l a r g e .   I f   a   d e v i c e   w i t h   t h o s e   a t t r i b u t e s   i s   n o t   a v a i l a b l e ,   t h e   p o d   c a n n o t   b e   s c h e d u l e d .   W i t h   t h e   p r i o r i t i z e d   l i s t   f e a t u r e ,   a   s e c o n d   a l t e r n a t i v e   c a n   b e   s p e c i f i e d ,   w h i c h   r e q u e s t s   t w o   d e v i c e s   w i t h   t h e   c o l o r   w h i t e   a n d   s i z e   s m a l l .   T h e   l a r g e   b l a c k   d e v i c e   w i l l   b e   a l l o c a t e d   i f   i t   i s   a v a i l a b l e .   I f   i t   i s   n o t ,   b u t   t w o   s m a l l   w h i t e   d e v i c e s   a r e   a v a i l a b l e ,   t h e   p o d   w i l l   s t i l l   b e   a b l e   t o   r u n .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   k i n d :   R e s o u r c e C l a i m T e m p l a t e   m e t a d a t a :   n a m e :   p r i o r i t i z e d - l i s t - c l a i m - t e m p l a t e   s p e c :   s p e c :   d e v i c e s :   r e q u e s t s :   -   n a m e :   r e q - 0   f i r s t A v a i l a b l e :   -   n a m e :   l a r g e - b l a c k   d e v i c e C l a s s N a m e :   r e s o u r c e . e


Question: What is ResourceSlice?

Answer: E a c h   R e s o u r c e S l i c e   r e p r e s e n t s   o n e   o r   m o r e   d e v i c e s   i n   a   p o o l .   T h e   p o o l   i s   m a n a g e d   b y   a   d e v i c e   d r i v e r ,   w h i c h   c r e a t e s   a n d   m a n a g e s   R e s o u r c e S l i c e s .   T h e   r e s o u r c e s   i n   a   p o o l   m i g h t   b e   r e p r e s e n t e d   b y   a   s i n g l e   R e s o u r c e S l i c e   o r   s p a n   m u l t i p l e   R e s o u r c e S l i c e s .   R e s o u r c e S l i c e s   p r o v i d e   u s e f u l   i n f o r m a t i o n   t o   d e v i c e   u s e r s   a n d   t o   t h e   s c h e d u l e r ,   a n d   a r e   c r u c i a l   f o r   d y n a m i c   r e s o u r c e   a l l o c a t i o n .   E v e r y   R e s o u r c e S l i c e   m u s t   i n c l u d e   t h e   f o l l o w i n g   i n f o r m a t i o n :   R e s o u r c e   p o o l :   a   g r o u p   o f   o n e   o r   m o r e   r e s o u r c e s   t h a t   t h e   d r i v e r   m a n a g e s .   T h e   p o o l   c a n   s p a n   m o r e   t h a n   o n e   R e s o u r c e S l i c e .   C h a n g e s   t o   t h e   r e s o u r c e s   i n   a   p o o l   m u s t   b e   p r o p a g a t e d   a c r o s s   a l l   o f   t h e   R e s o u r c e S l i c e s   i n   t h a t   p o o l .   T h e   d e v i c e   d r i v e r   t h a t   m a n a g e s   t h e   p o o l   i s   r e s p o n s i b l e   f o r   e n s u r i n g   t h a t   t h i s   p r o p a g a t i o n   h a p p e n s . D e v i c e s :   d e v i c e s   i n   t h e   m a n a g e d   p o o l .   A   R e s o u r c e S l i c e   c a n   l i s t   e v e r y   d e v i c e   i n   a   p o o l   o r   a   s u b s e t   o f   t h e   d e v i c e s   i n   a   p o o l .   T h e   R e s o u r c e S l i c e   d e f i n e s   d e v i c e   i n f o r m a t i o n   l i k e   a t t r i b u t e s ,   v e r s i o n s ,   a n d   c a p a c i t y .   D e v i c e   u s e r s   c a n   s e l e c t   d e v i c e s   f o r


Question: What is How resource allocation with DRA works?

Answer: T h e   f o l l o w i n g   s e c t i o n s   d e s c r i b e   t h e   w o r k f l o w   f o r   t h e   v a r i o u s   t y p e s   o f   D R A   u s e r s   a n d   f o r   t h e   K u b e r n e t e s   s y s t e m   d u r i n g   d y n a m i c   r e s o u r c e   a l l o c a t i o n .


Question: What is Workflow for users?

Answer: D r i v e r   c r e a t i o n :   d e v i c e   o w n e r s   o r   t h i r d - p a r t y   e n t i t i e s   c r e a t e   d r i v e r s   t h a t   c a n   c r e a t e   a n d   m a n a g e   R e s o u r c e S l i c e s   i n   t h e   c l u s t e r .   T h e s e   d r i v e r s   o p t i o n a l l y   a l s o   c r e a t e   D e v i c e C l a s s e s   t h a t   d e f i n e   a   c a t e g o r y   o f   d e v i c e s   a n d   h o w   t o   r e q u e s t   t h e m . C l u s t e r   c o n f i g u r a t i o n :   c l u s t e r   a d m i n s   c r e a t e   c l u s t e r s ,   a t t a c h   d e v i c e s   t o   n o d e s ,   a n d   i n s t a l l   t h e   D R A   d e v i c e   d r i v e r s .   C l u s t e r   a d m i n s   o p t i o n a l l y   c r e a t e   D e v i c e C l a s s e s   t h a t   d e f i n e   c a t e g o r i e s   o f   d e v i c e s   a n d   h o w   t o   r e q u e s t   t h e m . R e s o u r c e   c l a i m s :   w o r k l o a d   o p e r a t o r s   c r e a t e   R e s o u r c e C l a i m T e m p l a t e s   o r   R e s o u r c e C l a i m s   t h a t   r e q u e s t   s p e c i f i c   d e v i c e   c o n f i g u r a t i o n s   w i t h i n   a   D e v i c e C l a s s .   I n   t h e   s a m e   s t e p ,   w o r k l o a d   o p e r a t o r s   m o d i f y   t h e i r   K u b e r n e t e s   m a n i f e s t s   t o   r e q u e s t   t h o s e   R e s o u r c e C l a i m T e m p l a t e s   o r   R e s o u r c e C l a i m s .


Question: What is Workflow for Kubernetes?

Answer: R e s o u r c e S l i c e   c r e a t i o n :   d r i v e r s   i n   t h e   c l u s t e r   c r e a t e   R e s o u r c e S l i c e s   t h a t   r e p r e s e n t   o n e   o r   m o r e   d e v i c e s   i n   a   m a n a g e d   p o o l   o f   s i m i l a r   d e v i c e s . W o r k l o a d   c r e a t i o n :   t h e   c l u s t e r   c o n t r o l   p l a n e   c h e c k s   n e w   w o r k l o a d s   f o r   r e f e r e n c e s   t o   R e s o u r c e C l a i m T e m p l a t e s   o r   t o   s p e c i f i c   R e s o u r c e C l a i m s . I f   t h e   w o r k l o a d   u s e s   a   R e s o u r c e C l a i m T e m p l a t e ,   a   c o n t r o l l e r   n a m e d   t h e   r e s o u r c e c l a i m - c o n t r o l l e r   g e n e r a t e s   R e s o u r c e C l a i m s   f o r   e v e r y   P o d   i n   t h e   w o r k l o a d . I f   t h e   w o r k l o a d   u s e s   a   s p e c i f i c   R e s o u r c e C l a i m ,   K u b e r n e t e s   c h e c k s   w h e t h e r   t h a t   R e s o u r c e C l a i m   e x i s t s   i n   t h e   c l u s t e r .   I f   t h e   R e s o u r c e C l a i m   d o e s n ' t   e x i s t ,   t h e   P o d s   w o n ' t   d e p l o y . R e s o u r c e S l i c e   f i l t e r i n g :   f o r   e v e r y   P o d ,   K u b e r n e t e s   c h e c k s   t h e   R e s o u r c e S l i c e s   i n   t h e   c l u s t e r   t o   f i n d   a   d e v i c e   t h a t   s a t i s f i e s   a l l   o f   t h e   f o l l o w i n g   c r i t e r i a : T h e   n o d e s   t h a t   c a n   a c c e s s   t h e   r e s o u r c e s   a r e   e l i g i b l e   t o   r u n   t h e   P o d . T h e   R e s o u r c e S l i c e   h a s   u n a l l o c a t e d   r e s o u r c e s   t h a t   m a t c h   t h e   r e q u i r e m e n t s   o f   t h e   P o d ' s   R e s o u r c e C l a i m . R e s o u r c e   a l l o c a t i o n :   a f t e r   f i n d i n g   a n   e l i g i b l e   R e s o u r c e S l i c e   f o r   a   P o d ' s   R e s o u r


Question: What is Observability of dynamic resources?

Answer: Y o u   c a n   c h e c k   t h e   s t a t u s   o f   d y n a m i c a l l y   a l l o c a t e d   r e s o u r c e s   b y   u s i n g   a n y   o f   t h e   f o l l o w i n g   m e t h o d s :   k u b e l e t   d e v i c e   m e t r i c s R e s o u r c e C l a i m   s t a t u s D e v i c e   h e a l t h   m o n i t o r i n g


Question: What is kubelet device metrics?

Answer: T h e   P o d R e s o u r c e s L i s t e r   k u b e l e t   g R P C   s e r v i c e   l e t s   y o u   m o n i t o r   i n - u s e   d e v i c e s .   T h e   D y n a m i c R e s o u r c e   m e s s a g e   p r o v i d e s   i n f o r m a t i o n   t h a t ' s   s p e c i f i c   t o   d y n a m i c   r e s o u r c e   a l l o c a t i o n ,   s u c h   a s   t h e   d e v i c e   n a m e   a n d   t h e   c l a i m   n a m e .   F o r   d e t a i l s ,   s e e   M o n i t o r i n g   d e v i c e   p l u g i n   r e s o u r c e s .


Question: What is ResourceClaim device status?

Answer: D R A   d r i v e r s   c a n   r e p o r t   d r i v e r - s p e c i f i c   d e v i c e   s t a t u s   d a t a   f o r   e a c h   a l l o c a t e d   d e v i c e   i n   t h e   s t a t u s . d e v i c e s   f i e l d   o f   a   R e s o u r c e C l a i m .   F o r   e x a m p l e ,   t h e   d r i v e r   m i g h t   l i s t   t h e   I P   a d d r e s s e s   t h a t   a r e   a s s i g n e d   t o   a   n e t w o r k   i n t e r f a c e   d e v i c e .   T h e   a c c u r a c y   o f   t h e   i n f o r m a t i o n   t h a t   a   d r i v e r   a d d s   t o   a   R e s o u r c e C l a i m   s t a t u s . d e v i c e s   f i e l d   d e p e n d s   o n   t h e   d r i v e r .   E v a l u a t e   d r i v e r s   t o   d e c i d e   w h e t h e r   y o u   c a n   r e l y   o n   t h i s   f i e l d   a s   t h e   o n l y   s o u r c e   o f   d e v i c e   i n f o r m a t i o n .   I f   y o u   d i s a b l e   t h e   D R A R e s o u r c e C l a i m D e v i c e S t a t u s   f e a t u r e   g a t e ,   t h e   s t a t u s . d e v i c e s   f i e l d   a u t o m a t i c a l l y   g e t s   c l e a r e d   w h e n   s t o r i n g   t h e   R e s o u r c e C l a i m .   A   R e s o u r c e C l a i m   d e v i c e   s t a t u s   i s   s u p p o r t e d   w h e n   i t   i s   p o s s i b l e ,   f r o m   a   D R A   d r i v e r ,   t o   u p d a t e   a n   e x i s t i n g   R e s o u r c e C l a i m   w h e r e   t h e   s t a t u s . d e v i c e s   f i e l d   i s   s e t .   F o r   d e t a i l s   a b o u t   t h e   s t a t u s . d e v i c e s   f i e l d ,   s e e   t h e   R e s o u r c e C l a i m   A P I   r e f e r e n c e .


Question: What is Device Health Monitoring?

Answer: A s   a n   a l p h a   f e a t u r e ,   K u b e r n e t e s   p r o v i d e s   a   m e c h a n i s m   f o r   m o n i t o r i n g   a n d   r e p o r t i n g   t h e   h e a l t h   o f   d y n a m i c a l l y   a l l o c a t e d   i n f r a s t r u c t u r e   r e s o u r c e s .   F o r   s t a t e f u l   a p p l i c a t i o n s   r u n n i n g   o n   s p e c i a l i z e d   h a r d w a r e ,   i t   i s   c r i t i c a l   t o   k n o w   w h e n   a   d e v i c e   h a s   f a i l e d   o r   b e c o m e   u n h e a l t h y .   I t   i s   a l s o   h e l p f u l   t o   f i n d   o u t   i f   t h e   d e v i c e   r e c o v e r s .   T o   e n a b l e   t h i s   f u n c t i o n a l i t y ,   t h e   R e s o u r c e H e a l t h S t a t u s   f e a t u r e   g a t e   m u s t   b e   e n a b l e d ,   a n d   t h e   D R A   d r i v e r   m u s t   i m p l e m e n t   t h e   D R A R e s o u r c e H e a l t h   g R P C   s e r v i c e .   W h e n   a   D R A   d r i v e r   d e t e c t s   t h a t   a n   a l l o c a t e d   d e v i c e   h a s   b e c o m e   u n h e a l t h y ,   i t   r e p o r t s   t h i s   s t a t u s   b a c k   t o   t h e   k u b e l e t .   T h i s   h e a l t h   i n f o r m a t i o n   i s   t h e n   e x p o s e d   d i r e c t l y   i n   t h e   P o d ' s   s t a t u s .   T h e   k u b e l e t   p o p u l a t e s   t h e   a l l o c a t e d R e s o u r c e s S t a t u s   f i e l d   i n   t h e   s t a t u s   o f   e a c h   c o n t a i n e r ,   d e t a i l i n g   t h e   h e a l t h   o f   e a c h   d e v i c e   a s s i g n e d   t o   t h a t   c o n t a i n e r .   T h i s   p r o v i d e s   c r u c i a l   v i s i b i l i t y   f o r   u s e r s   a n d   c o n t r o l l e r s   t o   r e a c t   t o   h a r d w a r e   f a i l u r e s .   F o r   a   P o d   t h a t   i s   f a i l i n g ,   y o u   c a n   i n s p e c t   t h i s   s t a t u s   t o   d e t e r m i n e   i f   t h e   f a i l u r e   w a s


Question: What is Pre-scheduled Pods?

Answer: W h e n   y o u   -   o r   a n o t h e r   A P I   c l i e n t   -   c r e a t e   a   P o d   w i t h   s p e c . n o d e N a m e   a l r e a d y   s e t ,   t h e   s c h e d u l e r   g e t s   b y p a s s e d .   I f   s o m e   R e s o u r c e C l a i m   n e e d e d   b y   t h a t   P o d   d o e s   n o t   e x i s t   y e t ,   i s   n o t   a l l o c a t e d   o r   n o t   r e s e r v e d   f o r   t h e   P o d ,   t h e n   t h e   k u b e l e t   w i l l   f a i l   t o   r u n   t h e   P o d   a n d   r e - c h e c k   p e r i o d i c a l l y   b e c a u s e   t h o s e   r e q u i r e m e n t s   m i g h t   s t i l l   g e t   f u l f i l l e d   l a t e r .   S u c h   a   s i t u a t i o n   c a n   a l s o   a r i s e   w h e n   s u p p o r t   f o r   d y n a m i c   r e s o u r c e   a l l o c a t i o n   w a s   n o t   e n a b l e d   i n   t h e   s c h e d u l e r   a t   t h e   t i m e   w h e n   t h e   P o d   g o t   s c h e d u l e d   ( v e r s i o n   s k e w ,   c o n f i g u r a t i o n ,   f e a t u r e   g a t e ,   e t c . ) .   k u b e - c o n t r o l l e r - m a n a g e r   d e t e c t s   t h i s   a n d   t r i e s   t o   m a k e   t h e   P o d   r u n n a b l e   b y   r e s e r v i n g   t h e   r e q u i r e d   R e s o u r c e C l a i m s .   H o w e v e r ,   t h i s   o n l y   w o r k s   i f   t h o s e   w e r e   a l l o c a t e d   b y   t h e   s c h e d u l e r   f o r   s o m e   o t h e r   p o d .   I t   i s   b e t t e r   t o   a v o i d   b y p a s s i n g   t h e   s c h e d u l e r   b e c a u s e   a   P o d   t h a t   i s   a s s i g n e d   t o   a   n o d e   b l o c k s   n o r m a l   r e s o u r c e s   ( R A M ,   C P U )   t h a t   t h e n   c a n n o t   b e   u s e d   f o r   o t h e r   P o d s   w h i l e   t h e   P o d   i s   s t u c k .   T o   m a k e   a   P o d   r u n   o n   a   s p e c i f i c   n o d e   w h i l e   s t i l l   g o i n g   t h r o u g h   t h e   n o r


Question: What is DRA beta features?

Answer: T h e   f o l l o w i n g   s e c t i o n s   d e s c r i b e   D R A   f e a t u r e s   t h a t   a r e   a v a i l a b l e   i n   t h e   B e t a   f e a t u r e   s t a g e .   F o r   m o r e   i n f o r m a t i o n ,   s e e   S e t   u p   D R A   i n   t h e   c l u s t e r .


Question: What is Admin access?

Answer: Y o u   c a n   m a r k   a   r e q u e s t   i n   a   R e s o u r c e C l a i m   o r   R e s o u r c e C l a i m T e m p l a t e   a s   h a v i n g   p r i v i l e g e d   f e a t u r e s   f o r   m a i n t e n a n c e   a n d   t r o u b l e s h o o t i n g   t a s k s .   A   r e q u e s t   w i t h   a d m i n   a c c e s s   g r a n t s   a c c e s s   t o   i n - u s e   d e v i c e s   a n d   m a y   e n a b l e   a d d i t i o n a l   p e r m i s s i o n s   w h e n   m a k i n g   t h e   d e v i c e   a v a i l a b l e   i n   a   c o n t a i n e r :   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   k i n d :   R e s o u r c e C l a i m T e m p l a t e   m e t a d a t a :   n a m e :   l a r g e - b l a c k - c a t - c l a i m - t e m p l a t e   s p e c :   s p e c :   d e v i c e s :   r e q u e s t s :   -   n a m e :   r e q - 0   e x a c t l y :   d e v i c e C l a s s N a m e :   r e s o u r c e . e x a m p l e . c o m   a l l o c a t i o n M o d e :   A l l   a d m i n A c c e s s :   t r u e   I f   t h i s   f e a t u r e   i s   d i s a b l e d ,   t h e   a d m i n A c c e s s   f i e l d   w i l l   b e   r e m o v e d   a u t o m a t i c a l l y   w h e n   c r e a t i n g   s u c h   a   R e s o u r c e C l a i m .   A d m i n   a c c e s s   i s   a   p r i v i l e g e d   m o d e   a n d   s h o u l d   n o t   b e   g r a n t e d   t o   r e g u l a r   u s e r s   i n   m u l t i - t e n a n t   c l u s t e r s .   S t a r t i n g   w i t h   K u b e r n e t e s   v 1 . 3 3 ,   o n l y   u s e r s   a u t h o r i z e d   t o   c r e a t e   R e s o u r c e C l a i m   o r   R e s o u r c e C l a i m T e m p l a t e   o b j e c t s   i n   n a m e s p a c e s   l a b e l e d   w i t h   r e s o u r c e . k 8 s . i o / a d m i n - a c c e s s :   " t r u e "   ( c a s e - s e n s i t i v e )   c a n   u s e   t h e   a d m i n A c c e s s   f i e l d .   T h i s   e n s u r e s   t h a t   n o n - a d m i n   u s e r s


Question: What is DRA alpha features?

Answer: T h e   f o l l o w i n g   s e c t i o n s   d e s c r i b e   D R A   f e a t u r e s   t h a t   a r e   a v a i l a b l e   i n   t h e   A l p h a   f e a t u r e   s t a g e .   T o   u s e   a n y   o f   t h e s e   f e a t u r e s ,   y o u   m u s t   a l s o   s e t   u p   D R A   i n   y o u r   c l u s t e r s   b y   e n a b l i n g   t h e   D y n a m i c R e s o u r c e A l l o c a t i o n   f e a t u r e   g a t e   a n d   t h e   D R A   A P I   g r o u p s .   F o r   m o r e   i n f o r m a t i o n ,   s e e   S e t   u p   D R A   i n   t h e   c l u s t e r .


Question: What is Extended resource allocation by DRA?

Answer: Y o u   c a n   p r o v i d e   a n   e x t e n d e d   r e s o u r c e   n a m e   f o r   a   D e v i c e C l a s s .   T h e   s c h e d u l e r   w i l l   t h e n   s e l e c t   t h e   d e v i c e s   m a t c h i n g   t h e   c l a s s   f o r   t h e   e x t e n d e d   r e s o u r c e   r e q u e s t s .   T h i s   a l l o w s   u s e r s   t o   c o n t i n u e   u s i n g   e x t e n d e d   r e s o u r c e   r e q u e s t s   i n   a   p o d   t o   r e q u e s t   e i t h e r   e x t e n d e d   r e s o u r c e s   p r o v i d e d   b y   d e v i c e   p l u g i n ,   o r   D R A   d e v i c e s .   T h e   s a m e   e x t e n d e d   r e s o u r c e   c a n   b e   p r o v i d e d   e i t h e r   b y   d e v i c e   p l u g i n ,   o r   D R A   o n   o n e   s i n g l e   c l u s t e r   n o d e .   T h e   s a m e   e x t e n d e d   r e s o u r c e   c a n   b e   p r o v i d e d   b y   d e v i c e   p l u g i n   o n   s o m e   n o d e s ,   a n d   D R A   o n   o t h e r   n o d e s   i n   t h e   s a m e   c l u s t e r .   I n   t h e   e x a m p l e   b e l o w ,   t h e   D e v i c e C l a s s   i s   g i v e n   a n   e x t e n d e d R e s o u r c e N a m e   e x a m p l e . c o m / g p u .   I f   a   p o d   r e q u e s t e d   f o r   t h e   e x t e n d e d   r e s o u r c e   e x a m p l e . c o m / g p u :   2 ,   i t   c a n   b e   s c h e d u l e d   t o   a   n o d e   w i t h   t w o   o r   m o r e   d e v i c e s   m a t c h i n g   t h e   D e v i c e C l a s s .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   k i n d :   D e v i c e C l a s s   m e t a d a t a :   n a m e :   g p u . e x a m p l e . c o m   s p e c :   s e l e c t o r s :   -   c e l :   e x p r e s s i o n :   d e v i c e . d r i v e r   = =   ' g p u . e x a m p l e . c o m '   & &   d e v i c e . a t t r i b u t e s [ ' g p u . e x a m p l e . c o m ' ] . t y p e   = =   ' g p u '   e x t e n d e d R e s o u r c e N a m e :   e x a m p


Question: What is Partitionable devices?

Answer: D e v i c e s   r e p r e s e n t e d   i n   D R A   d o n ' t   n e c e s s a r i l y   h a v e   t o   b e   a   s i n g l e   u n i t   c o n n e c t e d   t o   a   s i n g l e   m a c h i n e ,   b u t   c a n   a l s o   b e   a   l o g i c a l   d e v i c e   c o m p r i s e d   o f   m u l t i p l e   d e v i c e s   c o n n e c t e d   t o   m u l t i p l e   m a c h i n e s .   T h e s e   d e v i c e s   m i g h t   c o n s u m e   o v e r l a p p i n g   r e s o u r c e s   o f   t h e   u n d e r l y i n g   p h y i c a l   d e v i c e s ,   m e a n i n g   t h a t   w h e n   o n e   l o g i c a l   d e v i c e   i s   a l l o c a t e d   o t h e r   d e v i c e s   w i l l   n o   l o n g e r   b e   a v a i l a b l e .   I n   t h e   R e s o u r c e S l i c e   A P I ,   t h i s   i s   r e p r e s e n t e d   a s   a   l i s t   o f   n a m e d   C o u n t e r S e t s ,   e a c h   o f   w h i c h   c o n t a i n s   a   s e t   o f   n a m e d   c o u n t e r s .   T h e   c o u n t e r s   r e p r e s e n t   t h e   r e s o u r c e s   a v a i l a b l e   o n   t h e   p h y s i c a l   d e v i c e   t h a t   a r e   u s e d   b y   t h e   l o g i c a l   d e v i c e s   a d v e r t i s e d   t h r o u g h   D R A .   L o g i c a l   d e v i c e s   c a n   s p e c i f y   t h e   C o n s u m e s C o u n t e r s   l i s t .   E a c h   e n t r y   c o n t a i n s   a   r e f e r e n c e   t o   a   C o u n t e r S e t   a n d   a   s e t   o f   n a m e d   c o u n t e r s   w i t h   t h e   a m o u n t s   t h e y   w i l l   c o n s u m e .   S o   f o r   a   d e v i c e   t o   b e   a l l o c a t a b l e ,   t h e   r e f e r e n c e d   c o u n t e r   s e t s   m u s t   h a v e   s u f f i c i e n t   q u a n t i t y   f o r   t h e   c o u n t e r s   r e f e r e n c e d   b y   t h e   d e v i c e .   H e r e   i s   a n   e x a m p l e   o f   t w o   d e v i c e s ,   e a c h   c o n s u m i n g   6 G i   o f   m e m o r y   f r


Question: What is Consumable capacity?

Answer: T h e   c o n s u m a b l e   c a p a c i t y   f e a t u r e   a l l o w s   t h e   s a m e   d e v i c e s   t o   b e   c o n s u m e d   b y   m u l t i p l e   i n d e p e n d e n t   R e s o u r c e C l a i m s ,   w i t h   t h e   K u b e r n e t e s   s c h e d u l e r   m a n a g i n g   h o w   m u c h   o f   t h e   d e v i c e ' s   c a p a c i t y   i s   u s e d   u p   b y   e a c h   c l a i m .   T h i s   i s   a n a l o g o u s   t o   h o w   P o d s   c a n   s h a r e   t h e   r e s o u r c e s   o n   a   N o d e ;   R e s o u r c e C l a i m s   c a n   s h a r e   t h e   r e s o u r c e s   o n   a   D e v i c e .   T h e   d e v i c e   d r i v e r   c a n   s e t   a l l o w M u l t i p l e A l l o c a t i o n s   f i e l d   a d d e d   i n   . s p e c . d e v i c e s   o f   R e s o u r c e S l i c e   t o   a l l o w   a l l o c a t i n g   t h a t   d e v i c e   t o   m u l t i p l e   i n d e p e n d e n t   R e s o u r c e C l a i m s   o r   t o   m u l t i p l e   r e q u e s t s   w i t h i n   a   R e s o u r c e C l a i m .   U s e r s   c a n   s e t   c a p a c i t y   f i e l d   a d d e d   i n   s p e c . d e v i c e s . r e q u e s t s   o f   R e s o u r c e C l a i m   t o   s p e c i f y   t h e   d e v i c e   r e s o u r c e   r e q u i r e m e n t s   f o r   e a c h   a l l o c a t i o n .   F o r   t h e   d e v i c e   t h a t   a l l o w s   m u l t i p l e   a l l o c a t i o n s ,   t h e   r e q u e s t e d   c a p a c i t y   i s   d r a w n   f r o m   —   o r   c o n s u m e d   f r o m   —   i t s   t o t a l   c a p a c i t y ,   a   c o n c e p t   k n o w n   a s   c o n s u m a b l e   c a p a c i t y .   T h e n ,   t h e   s c h e d u l e r   e n s u r e s   t h a t   t h e   a g g r e g a t e   c o n s u m e d   c a p a c i t y   a c r o s s   a l l   c l a i m s   d o e s   n o t   e x c e e d   t h e   d e v i c e ’ s   o v e r a l l   c a p a c i t y .   F u r t h e r m o r e ,   d r i v e


Question: What is Device taints and tolerations?

Answer: D e v i c e   t a i n t s   a r e   s i m i l a r   t o   n o d e   t a i n t s :   a   t a i n t   h a s   a   s t r i n g   k e y ,   a   s t r i n g   v a l u e ,   a n d   a n   e f f e c t .   T h e   e f f e c t   i s   a p p l i e d   t o   t h e   R e s o u r c e C l a i m   w h i c h   i s   u s i n g   a   t a i n t e d   d e v i c e   a n d   t o   a l l   P o d s   r e f e r e n c i n g   t h a t   R e s o u r c e C l a i m .   T h e   " N o S c h e d u l e "   e f f e c t   p r e v e n t s   s c h e d u l i n g   t h o s e   P o d s .   T a i n t e d   d e v i c e s   a r e   i g n o r e d   w h e n   t r y i n g   t o   a l l o c a t e   a   R e s o u r c e C l a i m   b e c a u s e   u s i n g   t h e m   w o u l d   p r e v e n t   s c h e d u l i n g   o f   P o d s .   T h e   " N o E x e c u t e "   e f f e c t   i m p l i e s   " N o S c h e d u l e "   a n d   i n   a d d i t i o n   c a u s e s   e v i c t i o n   o f   a l l   P o d s   w h i c h   h a v e   b e e n   s c h e d u l e d   a l r e a d y .   T h i s   e v i c t i o n   i s   i m p l e m e n t e d   i n   t h e   d e v i c e   t a i n t   e v i c t i o n   c o n t r o l l e r   i n   k u b e - c o n t r o l l e r - m a n a g e r   b y   d e l e t i n g   a f f e c t e d   P o d s .   R e s o u r c e C l a i m s   c a n   t o l e r a t e   t a i n t s .   I f   a   t a i n t   i s   t o l e r a t e d ,   i t s   e f f e c t   d o e s   n o t   a p p l y .   A n   e m p t y   t o l e r a t i o n   m a t c h e s   a l l   t a i n t s .   A   t o l e r a t i o n   c a n   b e   l i m i t e d   t o   c e r t a i n   e f f e c t s   a n d / o r   m a t c h   c e r t a i n   k e y / v a l u e   p a i r s .   A   t o l e r a t i o n   c a n   c h e c k   t h a t   a   c e r t a i n   k e y   e x i s t s ,   r e g a r d l e s s   w h i c h   v a l u e   i t   h a s ,   o r   i t   c a n   c h e c k   f o r   s p e c i f i c   v a l u e s   o f   a   k e y .   F o r   m o r e   i n f o r m


Question: What is Taints set by the driver?

Answer: A   D R A   d r i v e r   c a n   a d d   t a i n t s   t o   t h e   d e v i c e   i n f o r m a t i o n   t h a t   i t   p u b l i s h e s   i n   R e s o u r c e S l i c e s .   C o n s u l t   t h e   d o c u m e n t a t i o n   o f   a   D R A   d r i v e r   t o   l e a r n   w h e t h e r   t h e   d r i v e r   u s e s   t a i n t s   a n d   w h a t   t h e i r   k e y s   a n d   v a l u e s   a r e .


Question: What is Taints set by an admin?

Answer: A n   a d m i n   o r   a   c o n t r o l   p l a n e   c o m p o n e n t   c a n   t a i n t   d e v i c e s   w i t h o u t   h a v i n g   t o   t e l l   t h e   D R A   d r i v e r   t o   i n c l u d e   t a i n t s   i n   i t s   d e v i c e   i n f o r m a t i o n   i n   R e s o u r c e S l i c e s .   T h e y   d o   t h a t   b y   c r e a t i n g   D e v i c e T a i n t R u l e s .   E a c h   D e v i c e T a i n t R u l e   a d d s   o n e   t a i n t   t o   d e v i c e s   w h i c h   m a t c h   t h e   d e v i c e   s e l e c t o r .   W i t h o u t   s u c h   a   s e l e c t o r ,   n o   d e v i c e s   a r e   t a i n t e d .   T h i s   m a k e s   i t   h a r d e r   t o   a c c i d e n t a l l y   e v i c t   a l l   p o d s   u s i n g   R e s o u r c e C l a i m s   w h e n   l e a v i n g   o u t   t h e   s e l e c t o r   b y   m i s t a k e .   D e v i c e s   c a n   b e   s e l e c t e d   b y   g i v i n g   t h e   n a m e   o f   a   D e v i c e C l a s s ,   d r i v e r ,   p o o l ,   a n d / o r   d e v i c e .   T h e   D e v i c e C l a s s   s e l e c t s   a l l   d e v i c e s   t h a t   a r e   s e l e c t e d   b y   t h e   s e l e c t o r s   i n   t h a t   D e v i c e C l a s s .   W i t h   j u s t   t h e   d r i v e r   n a m e ,   a n   a d m i n   c a n   t a i n t   a l l   d e v i c e s   m a n a g e d   b y   t h a t   d r i v e r ,   f o r   e x a m p l e   w h i l e   d o i n g   s o m e   k i n d   o f   m a i n t e n a n c e   o f   t h a t   d r i v e r   a c r o s s   t h e   e n t i r e   c l u s t e r .   A d d i n g   a   p o o l   n a m e   c a n   l i m i t   t h e   t a i n t   t o   a   s i n g l e   n o d e ,   i f   t h e   d r i v e r   m a n a g e s   n o d e - l o c a l   d e v i c e s .   F i n a l l y ,   a d d i n g   t h e   d e v i c e   n a m e   c a n   s e l e c t   o n e   s p e c i f i c   d e v i c e .   T h e   d e v i c e   n a m e   a n d   p o o l   n a m e   c a n   a l s o


Question: What is Device Binding Conditions?

Answer: D e v i c e   B i n d i n g   C o n d i t i o n s   a l l o w   t h e   K u b e r n e t e s   s c h e d u l e r   t o   d e l a y   P o d   b i n d i n g   u n t i l   e x t e r n a l   r e s o u r c e s ,   s u c h   a s   f a b r i c - a t t a c h e d   G P U s   o r   r e p r o g r a m m a b l e   F P G A s ,   a r e   c o n f i r m e d   t o   b e   r e a d y .   T h i s   w a i t i n g   b e h a v i o r   i s   i m p l e m e n t e d   i n   t h e   P r e B i n d   p h a s e   o f   t h e   s c h e d u l i n g   f r a m e w o r k .   D u r i n g   t h i s   p h a s e ,   t h e   s c h e d u l e r   c h e c k s   w h e t h e r   a l l   r e q u i r e d   d e v i c e   c o n d i t i o n s   a r e   s a t i s f i e d   b e f o r e   p r o c e e d i n g   w i t h   b i n d i n g .   T h i s   i m p r o v e s   s c h e d u l i n g   r e l i a b i l i t y   b y   a v o i d i n g   p r e m a t u r e   b i n d i n g   a n d   e n a b l e s   c o o r d i n a t i o n   w i t h   e x t e r n a l   d e v i c e   c o n t r o l l e r s .   T o   u s e   t h i s   f e a t u r e ,   d e v i c e   d r i v e r s   ( t y p i c a l l y   m a n a g e d   b y   d r i v e r   o w n e r s )   m u s t   p u b l i s h   t h e   f o l l o w i n g   f i e l d s   i n   t h e   D e v i c e   s e c t i o n   o f   a   R e s o u r c e S l i c e .   C l u s t e r   a d m i n i s t r a t o r s   m u s t   e n a b l e   t h e   D R A D e v i c e B i n d i n g C o n d i t i o n s   a n d   D R A R e s o u r c e C l a i m D e v i c e S t a t u s   f e a t u r e   g a t e s   f o r   t h e   s c h e d u l e r   t o   h o n o r   t h e s e   f i e l d s .   b i n d i n g C o n d i t i o n s :   A   l i s t   o f   c o n d i t i o n   t y p e s   t h a t   m u s t   b e   s e t   t o   T r u e   i n   t h e   s t a t u s . c o n d i t i o n s   f i e l d   o f   t h e   a s s o c i a t e d   R e s o u r c e C l a i m   b e f o r e   t h e   P o d   c a n   b e   b o u n d .   T h e s e   t y p i c a


Question: What is What's next?

Answer: S e t   U p   D R A   i n   a   C l u s t e r A l l o c a t e   d e v i c e s   t o   w o r k l o a d s   u s i n g   D R A F o r   m o r e   i n f o r m a t i o n   o n   t h e   d e s i g n ,   s e e   t h e   D y n a m i c   R e s o u r c e   A l l o c a t i o n   w i t h   S t r u c t u r e d   P a r a m e t e r s   K E P .


Question: What is Webhook Mode?

Answer: Webhook ModeA WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.When specified, mode Webhook causes Kubernetes to query an outside REST service when determining user privileges.Configuration File FormatMode Webhook requires a file for HTTP configuration, specify by the --authorization-webhook-config-file=SOME_FILENAME flag.The configuration file uses the kubeconfig file format. Within the file "users" refers to the API Server webhook and "clusters" refers to the remote service.A configuration example which uses HTTPS client auth:# Kubernetes API version apiVersion: v1 # kind of the API object kind: Config # clusters refers to the remote service. clusters: - name: name-of-remote-authz-service cluster: # CA for verifying the remote service. certificate-authority: /path/to/ca.pem # URL of remote service to query. Must use 'https'. May not include parameters. server: https://authz.example.com/authorize # users refers to the API Server's webhook configuration. users: - name: name-of-api-server user: client-certificate: /path/to/cert.pem # cert for the webhook plugin to use client-key: /path/to/key.pem # key matching the cert # kubeconfig files require a context. Provide one for the API Server. current-context: webhook contexts: - context: cluster: name-of-remote-authz-service user: name-of-api-server name: webhook Request PayloadsWhen faced with an authorization decision, the API Server POSTs a JSON- serialized authorization.k8s.io/v1beta1 SubjectAccessReview object describing the action. This object contains fields describing the user attempting to make the request, and either details about the resource being accessed or requests attributes.Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the authorization.k8s.io/v1beta1 API extensions group (--runtime-config=authorization.k8s.io/v1beta1=true).An example request body:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "namespace": "kittensandponies", "verb": "get", "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", "group": [ "group1", "group2" ] } } The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored and may be omitted. A permissive response would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": true } } For disallowing access there are two methods.The first method is preferred in most cases, and indicates the authorization


Question: How does Webhook Mode work?

Answer: Webhook ModeA WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.When specified, mode Webhook causes Kubernetes to query an outside REST service when determining user privileges.Configuration File FormatMode Webhook requires a file for HTTP configuration, specify by the --authorization-webhook-config-file=SOME_FILENAME flag.The configuration file uses the kubeconfig file format. Within the file "users" refers to the API Server webhook and "clusters" refers to the remote service.A configuration example which uses HTTPS client auth:# Kubernetes API version apiVersion: v1 # kind of the API object kind: Config # clusters refers to the remote service. clusters: - name: name-of-remote-authz-service cluster: # CA for verifying the remote service. certificate-authority: /path/to/ca.pem # URL of remote service to query. Must use 'https'. May not include parameters. server: https://authz.example.com/authorize # users refers to the API Server's webhook configuration. users: - name: name-of-api-server user: client-certificate: /path/to/cert.pem # cert for the webhook plugin to use client-key: /path/to/key.pem # key matching the cert # kubeconfig files require a context. Provide one for the API Server. current-context: webhook contexts: - context: cluster: name-of-remote-authz-service user: name-of-api-server name: webhook Request PayloadsWhen faced with an authorization decision, the API Server POSTs a JSON- serialized authorization.k8s.io/v1beta1 SubjectAccessReview object describing the action. This object contains fields describing the user attempting to make the request, and either details about the resource being accessed or requests attributes.Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the authorization.k8s.io/v1beta1 API extensions group (--runtime-config=authorization.k8s.io/v1beta1=true).An example request body:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "namespace": "kittensandponies", "verb": "get", "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", "group": [ "group1", "group2" ] } } The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored and may be omitted. A permissive response would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": true } } For disallowing access there are two methods.The first method is preferred in most cases, and indicates the authorization


Question: When would you use Webhook Mode?

Answer: Webhook ModeA WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.When specified, mode Webhook causes Kubernetes to query an outside REST service when determining user privileges.Configuration File FormatMode Webhook requires a file for HTTP configuration, specify by the --authorization-webhook-config-file=SOME_FILENAME flag.The configuration file uses the kubeconfig file format. Within the file "users" refers to the API Server webhook and "clusters" refers to the remote service.A configuration example which uses HTTPS client auth:# Kubernetes API version apiVersion: v1 # kind of the API object kind: Config # clusters refers to the remote service. clusters: - name: name-of-remote-authz-service cluster: # CA for verifying the remote service. certificate-authority: /path/to/ca.pem # URL of remote service to query. Must use 'https'. May not include parameters. server: https://authz.example.com/authorize # users refers to the API Server's webhook configuration. users: - name: name-of-api-server user: client-certificate: /path/to/cert.pem # cert for the webhook plugin to use client-key: /path/to/key.pem # key matching the cert # kubeconfig files require a context. Provide one for the API Server. current-context: webhook contexts: - context: cluster: name-of-remote-authz-service user: name-of-api-server name: webhook Request PayloadsWhen faced with an authorization decision, the API Server POSTs a JSON- serialized authorization.k8s.io/v1beta1 SubjectAccessReview object describing the action. This object contains fields describing the user attempting to make the request, and either details about the resource being accessed or requests attributes.Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the authorization.k8s.io/v1beta1 API extensions group (--runtime-config=authorization.k8s.io/v1beta1=true).An example request body:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "namespace": "kittensandponies", "verb": "get", "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", "group": [ "group1", "group2" ] } } The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored and may be omitted. A permissive response would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": true } } For disallowing access there are two methods.The first method is preferred in most cases, and indicates the authorization


Question: What are the benefits of Webhook Mode?

Answer: Webhook ModeA WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.When specified, mode Webhook causes Kubernetes to query an outside REST service when determining user privileges.Configuration File FormatMode Webhook requires a file for HTTP configuration, specify by the --authorization-webhook-config-file=SOME_FILENAME flag.The configuration file uses the kubeconfig file format. Within the file "users" refers to the API Server webhook and "clusters" refers to the remote service.A configuration example which uses HTTPS client auth:# Kubernetes API version apiVersion: v1 # kind of the API object kind: Config # clusters refers to the remote service. clusters: - name: name-of-remote-authz-service cluster: # CA for verifying the remote service. certificate-authority: /path/to/ca.pem # URL of remote service to query. Must use 'https'. May not include parameters. server: https://authz.example.com/authorize # users refers to the API Server's webhook configuration. users: - name: name-of-api-server user: client-certificate: /path/to/cert.pem # cert for the webhook plugin to use client-key: /path/to/key.pem # key matching the cert # kubeconfig files require a context. Provide one for the API Server. current-context: webhook contexts: - context: cluster: name-of-remote-authz-service user: name-of-api-server name: webhook Request PayloadsWhen faced with an authorization decision, the API Server POSTs a JSON- serialized authorization.k8s.io/v1beta1 SubjectAccessReview object describing the action. This object contains fields describing the user attempting to make the request, and either details about the resource being accessed or requests attributes.Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the authorization.k8s.io/v1beta1 API extensions group (--runtime-config=authorization.k8s.io/v1beta1=true).An example request body:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "namespace": "kittensandponies", "verb": "get", "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", "group": [ "group1", "group2" ] } } The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored and may be omitted. A permissive response would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": true } } For disallowing access there are two methods.The first method is preferred in most cases, and indicates the authorization


Question: What is Webhook Mode?

Answer: A   W e b H o o k   i s   a n   H T T P   c a l l b a c k :   a n   H T T P   P O S T   t h a t   o c c u r s   w h e n   s o m e t h i n g   h a p p e n s ;   a   s i m p l e   e v e n t - n o t i f i c a t i o n   v i a   H T T P   P O S T .   A   w e b   a p p l i c a t i o n   i m p l e m e n t i n g   W e b H o o k s   w i l l   P O S T   a   m e s s a g e   t o   a   U R L   w h e n   c e r t a i n   t h i n g s   h a p p e n .   W h e n   s p e c i f i e d ,   m o d e   W e b h o o k   c a u s e s   K u b e r n e t e s   t o   q u e r y   a n   o u t s i d e   R E S T   s e r v i c e   w h e n   d e t e r m i n i n g   u s e r   p r i v i l e g e s .


Question: What is Configuration File Format?

Answer: M o d e   W e b h o o k   r e q u i r e s   a   f i l e   f o r   H T T P   c o n f i g u r a t i o n ,   s p e c i f y   b y   t h e   - - a u t h o r i z a t i o n - w e b h o o k - c o n f i g - f i l e = S O M E _ F I L E N A M E   f l a g .   T h e   c o n f i g u r a t i o n   f i l e   u s e s   t h e   k u b e c o n f i g   f i l e   f o r m a t .   W i t h i n   t h e   f i l e   " u s e r s "   r e f e r s   t o   t h e   A P I   S e r v e r   w e b h o o k   a n d   " c l u s t e r s "   r e f e r s   t o   t h e   r e m o t e   s e r v i c e .   A   c o n f i g u r a t i o n   e x a m p l e   w h i c h   u s e s   H T T P S   c l i e n t   a u t h :   #   K u b e r n e t e s   A P I   v e r s i o n   a p i V e r s i o n :   v 1   #   k i n d   o f   t h e   A P I   o b j e c t   k i n d :   C o n f i g   #   c l u s t e r s   r e f e r s   t o   t h e   r e m o t e   s e r v i c e .   c l u s t e r s :   -   n a m e :   n a m e - o f - r e m o t e - a u t h z - s e r v i c e   c l u s t e r :   #   C A   f o r   v e r i f y i n g   t h e   r e m o t e   s e r v i c e .   c e r t i f i c a t e - a u t h o r i t y :   / p a t h / t o / c a . p e m   #   U R L   o f   r e m o t e   s e r v i c e   t o   q u e r y .   M u s t   u s e   ' h t t p s ' .   M a y   n o t   i n c l u d e   p a r a m e t e r s .   s e r v e r :   h t t p s : / / a u t h z . e x a m p l e . c o m / a u t h o r i z e   #   u s e r s   r e f e r s   t o   t h e   A P I   S e r v e r ' s   w e b h o o k   c o n f i g u r a t i o n .   u s e r s :   -   n a m e :   n a m e - o f - a p i - s e r v e r   u s e r :   c l i e n t - c e r t i f i c a t e :   / p a t h / t o / c e r t . p e m   #   c e r t   f o r   t h e   w e b h o o k   p l u g i n   t o   u s e   c l i e n t - k e y :   / p a t h / t o / k e y . p e m   #   k e y   m a t c h i n g   t h e   c e r t   #   k u b e c o n f i g   f i l e s   r e q u i r e   a   c o n t e x t .   P r o v i d e   o n e   f o r   t h e   A P I


Question: What is Request Payloads?

Answer: W h e n   f a c e d   w i t h   a n   a u t h o r i z a t i o n   d e c i s i o n ,   t h e   A P I   S e r v e r   P O S T s   a   J S O N -   s e r i a l i z e d   a u t h o r i z a t i o n . k 8 s . i o / v 1 b e t a 1   S u b j e c t A c c e s s R e v i e w   o b j e c t   d e s c r i b i n g   t h e   a c t i o n .   T h i s   o b j e c t   c o n t a i n s   f i e l d s   d e s c r i b i n g   t h e   u s e r   a t t e m p t i n g   t o   m a k e   t h e   r e q u e s t ,   a n d   e i t h e r   d e t a i l s   a b o u t   t h e   r e s o u r c e   b e i n g   a c c e s s e d   o r   r e q u e s t s   a t t r i b u t e s .   N o t e   t h a t   w e b h o o k   A P I   o b j e c t s   a r e   s u b j e c t   t o   t h e   s a m e   v e r s i o n i n g   c o m p a t i b i l i t y   r u l e s   a s   o t h e r   K u b e r n e t e s   A P I   o b j e c t s .   I m p l e m e n t e r s   s h o u l d   b e   a w a r e   o f   l o o s e r   c o m p a t i b i l i t y   p r o m i s e s   f o r   b e t a   o b j e c t s   a n d   c h e c k   t h e   " a p i V e r s i o n "   f i e l d   o f   t h e   r e q u e s t   t o   e n s u r e   c o r r e c t   d e s e r i a l i z a t i o n .   A d d i t i o n a l l y ,   t h e   A P I   S e r v e r   m u s t   e n a b l e   t h e   a u t h o r i z a t i o n . k 8 s . i o / v 1 b e t a 1   A P I   e x t e n s i o n s   g r o u p   ( - - r u n t i m e - c o n f i g = a u t h o r i z a t i o n . k 8 s . i o / v 1 b e t a 1 = t r u e ) .   A n   e x a m p l e   r e q u e s t   b o d y :   {   " a p i V e r s i o n " :   " a u t h o r i z a t i o n . k 8 s . i o / v 1 b e t a 1 " ,   " k i n d " :   " S u b j e c t A c c e s s R e v i e w " ,   " s p e c " :   {   " r e s o u r c e A t t r i b u t e s " :   {   " n a m e s p a c e " :   " k i t t e n s a n d p o n i e s " ,   " v e r b " :   " g e t " ,   " g r o u p " :   " u n i c o r n . e x a m p l e . o r g " ,   " r e s o u r c e " :   " p o d s "   } ,   " u s e r " :   " j a n


Question: What is Service?

Answer: ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1import "k8s.io/api/core/v1"ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1kind: Servicemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ServiceSpec)Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ServiceStatus)Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusServiceSpecServiceSpec describes the attributes that a user creates on a service.selector (map[string]string)Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/ports ([]ServicePort)Patch strategy: merge on key portMap: unique values on keys port, protocol will be kept during a mergeThe list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesServicePort contains information on service's port.ports.port (int32), requiredThe port that will be exposed by this service.ports.targetPort (IntOrString)Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-serviceIntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.ports.protocol (string)The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP.ports.name (string)The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have uni


Question: How does Service work?

Answer: ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1import "k8s.io/api/core/v1"ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1kind: Servicemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ServiceSpec)Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ServiceStatus)Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusServiceSpecServiceSpec describes the attributes that a user creates on a service.selector (map[string]string)Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/ports ([]ServicePort)Patch strategy: merge on key portMap: unique values on keys port, protocol will be kept during a mergeThe list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesServicePort contains information on service's port.ports.port (int32), requiredThe port that will be exposed by this service.ports.targetPort (IntOrString)Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-serviceIntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.ports.protocol (string)The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP.ports.name (string)The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have uni


Question: When would you use Service?

Answer: ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1import "k8s.io/api/core/v1"ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1kind: Servicemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ServiceSpec)Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ServiceStatus)Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusServiceSpecServiceSpec describes the attributes that a user creates on a service.selector (map[string]string)Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/ports ([]ServicePort)Patch strategy: merge on key portMap: unique values on keys port, protocol will be kept during a mergeThe list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesServicePort contains information on service's port.ports.port (int32), requiredThe port that will be exposed by this service.ports.targetPort (IntOrString)Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-serviceIntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.ports.protocol (string)The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP.ports.name (string)The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have uni


Question: What are the benefits of Service?

Answer: ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1import "k8s.io/api/core/v1"ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1kind: Servicemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ServiceSpec)Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ServiceStatus)Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusServiceSpecServiceSpec describes the attributes that a user creates on a service.selector (map[string]string)Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/ports ([]ServicePort)Patch strategy: merge on key portMap: unique values on keys port, protocol will be kept during a mergeThe list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesServicePort contains information on service's port.ports.port (int32), requiredThe port that will be exposed by this service.ports.targetPort (IntOrString)Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-serviceIntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.ports.protocol (string)The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP.ports.name (string)The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have uni


Question: What is Service?

Answer: a p i V e r s i o n :   v 1   i m p o r t   " k 8 s . i o / a p i / c o r e / v 1 "


Question: What is Service?

Answer: S e r v i c e   i s   a   n a m e d   a b s t r a c t i o n   o f   s o f t w a r e   s e r v i c e   ( f o r   e x a m p l e ,   m y s q l )   c o n s i s t i n g   o f   l o c a l   p o r t   ( f o r   e x a m p l e   3 3 0 6 )   t h a t   t h e   p r o x y   l i s t e n s   o n ,   a n d   t h e   s e l e c t o r   t h a t   d e t e r m i n e s   w h i c h   p o d s   w i l l   a n s w e r   r e q u e s t s   s e n t   t h r o u g h   t h e   p r o x y .   a p i V e r s i o n :   v 1 k i n d :   S e r v i c e m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( S e r v i c e S p e c ) S p e c   d e f i n e s   t h e   b e h a v i o r   o f   a   s e r v i c e .   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s s t a t u s   ( S e r v i c e S t a t u s ) M o s t   r e c e n t l y   o b s e r v e d   s t a t u s   o f   t h e   s e r v i c e .   P o p u l a t e d   b y   t h e   s y s t e m .   R e a d - o n l y .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( S e r v i c e S p e c )   S p e c   d e f i n e s   t h


Question: What is ServiceSpec?

Answer: S e r v i c e S p e c   d e s c r i b e s   t h e   a t t r i b u t e s   t h a t   a   u s e r   c r e a t e s   o n   a   s e r v i c e .   s e l e c t o r   ( m a p [ s t r i n g ] s t r i n g ) R o u t e   s e r v i c e   t r a f f i c   t o   p o d s   w i t h   l a b e l   k e y s   a n d   v a l u e s   m a t c h i n g   t h i s   s e l e c t o r .   I f   e m p t y   o r   n o t   p r e s e n t ,   t h e   s e r v i c e   i s   a s s u m e d   t o   h a v e   a n   e x t e r n a l   p r o c e s s   m a n a g i n g   i t s   e n d p o i n t s ,   w h i c h   K u b e r n e t e s   w i l l   n o t   m o d i f y .   O n l y   a p p l i e s   t o   t y p e s   C l u s t e r I P ,   N o d e P o r t ,   a n d   L o a d B a l a n c e r .   I g n o r e d   i f   t y p e   i s   E x t e r n a l N a m e .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / s e r v i c e s - n e t w o r k i n g / s e r v i c e / p o r t s   ( [ ] S e r v i c e P o r t ) P a t c h   s t r a t e g y :   m e r g e   o n   k e y   p o r t M a p :   u n i q u e   v a l u e s   o n   k e y s   p o r t ,   p r o t o c o l   w i l l   b e   k e p t   d u r i n g   a   m e r g e T h e   l i s t   o f   p o r t s   t h a t   a r e   e x p o s e d   b y   t h i s   s e r v i c e .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / s e r v i c e s - n e t w o r k i n g / s e r v i c e / # v i r t u a l - i p s - a n d - s e r v i c e - p r o x i e s S e r v i c e P o r t   c o n t a i n s   i n f o r m a t i o n   o n   s e r v i c e ' s   p o r t . p o r t s . p o r t   ( i n t 3 2 ) ,   r e q u i r e d T h e   p o r t   t h a t   w i l l   b e   e x p o s e d   b y   t h i s   s e r v i c e . p o r t s . t a r g e t P o r t   ( I n t O r S t r i n g ) N u m b e r   o r   n a m e   o f   t h e   p o r t   t o   a c c e s s   o n   t h e   p o d s   t a r g e t e d   b y   t h e   s e r v i c e .   N u m b e r


Question: What is ServiceStatus?

Answer: S e r v i c e S t a t u s   r e p r e s e n t s   t h e   c u r r e n t   s t a t u s   o f   a   s e r v i c e .   c o n d i t i o n s   ( [ ] C o n d i t i o n ) P a t c h   s t r a t e g y :   m e r g e   o n   k e y   t y p e M a p :   u n i q u e   v a l u e s   o n   k e y   t y p e   w i l l   b e   k e p t   d u r i n g   a   m e r g e C u r r e n t   s e r v i c e   s t a t e C o n d i t i o n   c o n t a i n s   d e t a i l s   f o r   o n e   a s p e c t   o f   t h e   c u r r e n t   s t a t e   o f   t h i s   A P I   R e s o u r c e . c o n d i t i o n s . l a s t T r a n s i t i o n T i m e   ( T i m e ) ,   r e q u i r e d l a s t T r a n s i t i o n T i m e   i s   t h e   l a s t   t i m e   t h e   c o n d i t i o n   t r a n s i t i o n e d   f r o m   o n e   s t a t u s   t o   a n o t h e r .   T h i s   s h o u l d   b e   w h e n   t h e   u n d e r l y i n g   c o n d i t i o n   c h a n g e d .   I f   t h a t   i s   n o t   k n o w n ,   t h e n   u s i n g   t h e   t i m e   w h e n   t h e   A P I   f i e l d   c h a n g e d   i s   a c c e p t a b l e . T i m e   i s   a   w r a p p e r   a r o u n d   t i m e . T i m e   w h i c h   s u p p o r t s   c o r r e c t   m a r s h a l i n g   t o   Y A M L   a n d   J S O N .   W r a p p e r s   a r e   p r o v i d e d   f o r   m a n y   o f   t h e   f a c t o r y   m e t h o d s   t h a t   t h e   t i m e   p a c k a g e   o f f e r s . c o n d i t i o n s . m e s s a g e   ( s t r i n g ) ,   r e q u i r e d m e s s a g e   i s   a   h u m a n   r e a d a b l e   m e s s a g e   i n d i c a t i n g   d e t a i l s   a b o u t   t h e   t r a n s i t i o n .   T h i s   m a y   b e   a n   e m p t y   s t r i n g . c o n d i t i o n s . r e a s o n   ( s t r i n g ) ,   r e q u i r e d r e a s o n   c o n t a i n s   a   p r o g r a m m a t i c   i d e n t i f i e r   i n d i c a t i n g   t h e   r e a s o n   f o r   t h e   c o n d i t i o n ' s   l a s t   t r a n s i t i o n .


Question: What is ServiceList?

Answer: S e r v i c e L i s t   h o l d s   a   l i s t   o f   s e r v i c e s .   a p i V e r s i o n :   v 1 k i n d :   S e r v i c e L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s i t e m s   ( [ ] S e r v i c e ) ,   r e q u i r e d L i s t   o f   s e r v i c e s   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s   i t e m s   ( [ ] S e r v i c e ) ,   r e q u i r e d   L i s t   o f   s e r v i c e s


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   S e r v i c e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   S e r v i c e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e s / { n a m e } / s t a t u s