Question: How does SelfSubjectReview work?

Answer: SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.apiVersion: authentication.k8s.io/v1import "k8s.io/api/authentication/v1"SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.apiVersion: authentication.k8s.io/v1kind: SelfSubjectReviewmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatastatus (SelfSubjectReviewStatus)Status is filled in by the server with the user attributes.SelfSubjectReviewStatusSelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.userInfo (UserInfo)User attributes of the user making this request.UserInfo holds the information about the user needed to implement the user.Info interface.userInfo.extra (map[string][]string)Any additional information provided by the authenticator.userInfo.groups ([]string)Atomic: will be replaced during a mergeThe names of groups this user is a part of.userInfo.uid (string)A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.userInfo.username (string)The name that uniquely identifies this user among all active users.Operationscreate create a SelfSubjectReviewHTTP RequestPOST /apis/authentication.k8s.io/v1/selfsubjectreviewsParametersbody: SelfSubjectReview, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (SelfSubjectReview): OK201 (SelfSubjectReview): Created202 (SelfSubjectReview): Accepted401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use SelfSubjectReview?

Answer: SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.apiVersion: authentication.k8s.io/v1import "k8s.io/api/authentication/v1"SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.apiVersion: authentication.k8s.io/v1kind: SelfSubjectReviewmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatastatus (SelfSubjectReviewStatus)Status is filled in by the server with the user attributes.SelfSubjectReviewStatusSelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.userInfo (UserInfo)User attributes of the user making this request.UserInfo holds the information about the user needed to implement the user.Info interface.userInfo.extra (map[string][]string)Any additional information provided by the authenticator.userInfo.groups ([]string)Atomic: will be replaced during a mergeThe names of groups this user is a part of.userInfo.uid (string)A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.userInfo.username (string)The name that uniquely identifies this user among all active users.Operationscreate create a SelfSubjectReviewHTTP RequestPOST /apis/authentication.k8s.io/v1/selfsubjectreviewsParametersbody: SelfSubjectReview, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (SelfSubjectReview): OK201 (SelfSubjectReview): Created202 (SelfSubjectReview): Accepted401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of SelfSubjectReview?

Answer: SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.apiVersion: authentication.k8s.io/v1import "k8s.io/api/authentication/v1"SelfSubjectReviewSelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.apiVersion: authentication.k8s.io/v1kind: SelfSubjectReviewmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatastatus (SelfSubjectReviewStatus)Status is filled in by the server with the user attributes.SelfSubjectReviewStatusSelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.userInfo (UserInfo)User attributes of the user making this request.UserInfo holds the information about the user needed to implement the user.Info interface.userInfo.extra (map[string][]string)Any additional information provided by the authenticator.userInfo.groups ([]string)Atomic: will be replaced during a mergeThe names of groups this user is a part of.userInfo.uid (string)A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.userInfo.username (string)The name that uniquely identifies this user among all active users.Operationscreate create a SelfSubjectReviewHTTP RequestPOST /apis/authentication.k8s.io/v1/selfsubjectreviewsParametersbody: SelfSubjectReview, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (SelfSubjectReview): OK201 (SelfSubjectReview): Created202 (SelfSubjectReview): Accepted401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is SelfSubjectReview?

Answer: a p i V e r s i o n :   a u t h e n t i c a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / a u t h e n t i c a t i o n / v 1 "


Question: What is SelfSubjectReview?

Answer: S e l f S u b j e c t R e v i e w   c o n t a i n s   t h e   u s e r   i n f o r m a t i o n   t h a t   t h e   k u b e - a p i s e r v e r   h a s   a b o u t   t h e   u s e r   m a k i n g   t h i s   r e q u e s t .   W h e n   u s i n g   i m p e r s o n a t i o n ,   u s e r s   w i l l   r e c e i v e   t h e   u s e r   i n f o   o f   t h e   u s e r   b e i n g   i m p e r s o n a t e d .   I f   i m p e r s o n a t i o n   o r   r e q u e s t   h e a d e r   a u t h e n t i c a t i o n   i s   u s e d ,   a n y   e x t r a   k e y s   w i l l   h a v e   t h e i r   c a s e   i g n o r e d   a n d   r e t u r n e d   a s   l o w e r c a s e .   a p i V e r s i o n :   a u t h e n t i c a t i o n . k 8 s . i o / v 1 k i n d :   S e l f S u b j e c t R e v i e w m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s t a t u s   ( S e l f S u b j e c t R e v i e w S t a t u s ) S t a t u s   i s   f i l l e d   i n   b y   t h e   s e r v e r   w i t h   t h e   u s e r   a t t r i b u t e s .   a p i V e r s i o n :   a u t h e n t i c a t i o n . k 8 s . i o / v 1   k i n d :   S e l f S u b j e c t R e v i e w   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s t a t u s   ( S e l f S u b j e c t R e v i e w S t a t u s )   S t a t u s   i s   f i l l e d   i n   b y   t h e   s e r v e r   w i t h   t h e   u s e r   a t t r i b u t e s .


Question: What is SelfSubjectReviewStatus?

Answer: S e l f S u b j e c t R e v i e w S t a t u s   i s   f i l l e d   b y   t h e   k u b e - a p i s e r v e r   a n d   s e n t   b a c k   t o   a   u s e r .   u s e r I n f o   ( U s e r I n f o ) U s e r   a t t r i b u t e s   o f   t h e   u s e r   m a k i n g   t h i s   r e q u e s t . U s e r I n f o   h o l d s   t h e   i n f o r m a t i o n   a b o u t   t h e   u s e r   n e e d e d   t o   i m p l e m e n t   t h e   u s e r . I n f o   i n t e r f a c e . u s e r I n f o . e x t r a   ( m a p [ s t r i n g ] [ ] s t r i n g ) A n y   a d d i t i o n a l   i n f o r m a t i o n   p r o v i d e d   b y   t h e   a u t h e n t i c a t o r . u s e r I n f o . g r o u p s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e T h e   n a m e s   o f   g r o u p s   t h i s   u s e r   i s   a   p a r t   o f . u s e r I n f o . u i d   ( s t r i n g ) A   u n i q u e   v a l u e   t h a t   i d e n t i f i e s   t h i s   u s e r   a c r o s s   t i m e .   I f   t h i s   u s e r   i s   d e l e t e d   a n d   a n o t h e r   u s e r   b y   t h e   s a m e   n a m e   i s   a d d e d ,   t h e y   w i l l   h a v e   d i f f e r e n t   U I D s . u s e r I n f o . u s e r n a m e   ( s t r i n g ) T h e   n a m e   t h a t   u n i q u e l y   i d e n t i f i e s   t h i s   u s e r   a m o n g   a l l   a c t i v e   u s e r s .   u s e r I n f o   ( U s e r I n f o )   U s e r   a t t r i b u t e s   o f   t h e   u s e r   m a k i n g   t h i s   r e q u e s t .   U s e r I n f o   h o l d s   t h e   i n f o r m a t i o n   a b o u t   t h e   u s e r   n e e d e d   t o   i m p l e m e n t   t h e   u s e r . I n f o   i n t e r f a c e .   u s e r I n f o . e x t r a   ( m a p [ s t r i n g ] [ ] s t r i n g ) A n y   a d d i t i o n a l   i n f o r m a t i o n   p r o v i d e d   b y   t h e   a u t h e n t i c a t o r . u s e r I n f o . g r o u p s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e


Question: What is HTTP Request?

Answer: P O S T   / a p i s / a u t h e n t i c a t i o n . k 8 s . i o / v 1 / s e l f s u b j e c t r e v i e w s


Question: What is Parameters?

Answer: b o d y :   S e l f S u b j e c t R e v i e w ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   S e l f S u b j e c t R e v i e w ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e l f S u b j e c t R e v i e w ) :   O K   2 0 1   ( S e l f S u b j e c t R e v i e w ) :   C r e a t e d   2 0 2   ( S e l f S u b j e c t R e v i e w ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Feature Gates (removed)?

Answer: Feature Gates (removed)This page contains list of feature gates that have been removed. The information on this page is for reference. A removed feature gate is different from a GA'ed or deprecated one in that a removed one is no longer recognized as a valid feature gate. However, a GA'ed or a deprecated feature gate is still recognized by the corresponding Kubernetes components although they are unable to cause any behavior differences in a cluster.For feature gates that are still recognized by the Kubernetes components, please refer to the Alpha/Beta feature gate table or the Graduated/Deprecated feature gate tableFeature gates that are removedIn the following table:The "From" column contains the Kubernetes release when a feature is introduced or its release stage is changed.The "To" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate. If the feature stage is either "Deprecated" or "GA", the "To" column is the Kubernetes release when the feature is removed.Feature Gates RemovedFeatureDefaultStageFromToAcceleratorsfalseAlpha1.61.10Accelerators–Deprecated1.111.11AdmissionWebhookMatchConditionsfalseAlpha1.271.27AdmissionWebhookMatchConditionstrueBeta1.281.29AdmissionWebhookMatchConditionstrueGA1.301.32AdvancedAuditingfalseAlpha1.71.7AdvancedAuditingtrueBeta1.81.11AdvancedAuditingtrueGA1.121.27AffinityInAnnotationsfalseAlpha1.61.7AffinityInAnnotations–Deprecated1.81.8AggregatedDiscoveryEndpointfalseAlpha1.261.26AggregatedDiscoveryEndpointtrueBeta1.271.29AggregatedDiscoveryEndpointtrueGA1.301.32AllowExtTrafficLocalEndpointsfalseBeta1.41.6AllowExtTrafficLocalEndpointstrueGA1.71.9AllowInsecureBackendProxytrueBeta1.171.20AllowInsecureBackendProxytrueGA1.211.25APIListChunkingfalseAlpha1.81.8APIListChunkingtrueBeta1.91.28APIListChunkingtrueGA1.291.32APIPriorityAndFairnessfalseAlpha1.181.19APIPriorityAndFairnesstrueBeta1.201.28APIPriorityAndFairnesstrueGA1.291.30APISelfSubjectReviewfalseAlpha1.261.26APISelfSubjectReviewtrueBeta1.271.27APISelfSubjectReviewtrueGA1.281.29AppArmortrueBeta1.41.30AppArmortrueGA1.311.32AppArmorFieldstrueBeta1.301.30AppArmorFieldstrueGA1.311.32AttachVolumeLimitfalseAlpha1.111.11AttachVolumeLimittrueBeta1.121.16AttachVolumeLimittrueGA1.171.21BalanceAttachedNodeVolumesfalseAlpha1.111.21BalanceAttachedNodeVolumesfalseDeprecated1.221.22BlockVolumefalseAlpha1.91.12BlockVolumetrueBeta1.131.17BlockVolumetrueGA1.181.21BoundServiceAccountTokenVolumefalseAlpha1.131.20BoundServiceAccountTokenVolumetrueBeta1.211.21BoundServiceAccountTokenVolumetrueGA1.221.23CloudDualStackNodeIPsfalseAlpha1.271.28CloudDualStackNodeIPstrueBeta1.291.29CloudDualStackNodeIPstrueGA1.301.31ConfigurableFSGroupPolicyfalseAlpha1.181.19ConfigurableFSGroupPolicytrueBeta1.201.22ConfigurableFSGroupPolicytrueGA1.231.25ConsistentHTTPGetHandlerstrueGA1.251.30ControllerManagerLeaderMigrationfalseAlpha1.211.21ControllerManagerLeaderMigrationtrueBeta1.221.23ControllerManagerLeaderMigrationtrueGA1.241.26CPUManagerfalseAlpha1.81.9C


Question: How does Feature Gates (removed) work?

Answer: Feature Gates (removed)This page contains list of feature gates that have been removed. The information on this page is for reference. A removed feature gate is different from a GA'ed or deprecated one in that a removed one is no longer recognized as a valid feature gate. However, a GA'ed or a deprecated feature gate is still recognized by the corresponding Kubernetes components although they are unable to cause any behavior differences in a cluster.For feature gates that are still recognized by the Kubernetes components, please refer to the Alpha/Beta feature gate table or the Graduated/Deprecated feature gate tableFeature gates that are removedIn the following table:The "From" column contains the Kubernetes release when a feature is introduced or its release stage is changed.The "To" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate. If the feature stage is either "Deprecated" or "GA", the "To" column is the Kubernetes release when the feature is removed.Feature Gates RemovedFeatureDefaultStageFromToAcceleratorsfalseAlpha1.61.10Accelerators–Deprecated1.111.11AdmissionWebhookMatchConditionsfalseAlpha1.271.27AdmissionWebhookMatchConditionstrueBeta1.281.29AdmissionWebhookMatchConditionstrueGA1.301.32AdvancedAuditingfalseAlpha1.71.7AdvancedAuditingtrueBeta1.81.11AdvancedAuditingtrueGA1.121.27AffinityInAnnotationsfalseAlpha1.61.7AffinityInAnnotations–Deprecated1.81.8AggregatedDiscoveryEndpointfalseAlpha1.261.26AggregatedDiscoveryEndpointtrueBeta1.271.29AggregatedDiscoveryEndpointtrueGA1.301.32AllowExtTrafficLocalEndpointsfalseBeta1.41.6AllowExtTrafficLocalEndpointstrueGA1.71.9AllowInsecureBackendProxytrueBeta1.171.20AllowInsecureBackendProxytrueGA1.211.25APIListChunkingfalseAlpha1.81.8APIListChunkingtrueBeta1.91.28APIListChunkingtrueGA1.291.32APIPriorityAndFairnessfalseAlpha1.181.19APIPriorityAndFairnesstrueBeta1.201.28APIPriorityAndFairnesstrueGA1.291.30APISelfSubjectReviewfalseAlpha1.261.26APISelfSubjectReviewtrueBeta1.271.27APISelfSubjectReviewtrueGA1.281.29AppArmortrueBeta1.41.30AppArmortrueGA1.311.32AppArmorFieldstrueBeta1.301.30AppArmorFieldstrueGA1.311.32AttachVolumeLimitfalseAlpha1.111.11AttachVolumeLimittrueBeta1.121.16AttachVolumeLimittrueGA1.171.21BalanceAttachedNodeVolumesfalseAlpha1.111.21BalanceAttachedNodeVolumesfalseDeprecated1.221.22BlockVolumefalseAlpha1.91.12BlockVolumetrueBeta1.131.17BlockVolumetrueGA1.181.21BoundServiceAccountTokenVolumefalseAlpha1.131.20BoundServiceAccountTokenVolumetrueBeta1.211.21BoundServiceAccountTokenVolumetrueGA1.221.23CloudDualStackNodeIPsfalseAlpha1.271.28CloudDualStackNodeIPstrueBeta1.291.29CloudDualStackNodeIPstrueGA1.301.31ConfigurableFSGroupPolicyfalseAlpha1.181.19ConfigurableFSGroupPolicytrueBeta1.201.22ConfigurableFSGroupPolicytrueGA1.231.25ConsistentHTTPGetHandlerstrueGA1.251.30ControllerManagerLeaderMigrationfalseAlpha1.211.21ControllerManagerLeaderMigrationtrueBeta1.221.23ControllerManagerLeaderMigrationtrueGA1.241.26CPUManagerfalseAlpha1.81.9C


Question: When would you use Feature Gates (removed)?

Answer: Feature Gates (removed)This page contains list of feature gates that have been removed. The information on this page is for reference. A removed feature gate is different from a GA'ed or deprecated one in that a removed one is no longer recognized as a valid feature gate. However, a GA'ed or a deprecated feature gate is still recognized by the corresponding Kubernetes components although they are unable to cause any behavior differences in a cluster.For feature gates that are still recognized by the Kubernetes components, please refer to the Alpha/Beta feature gate table or the Graduated/Deprecated feature gate tableFeature gates that are removedIn the following table:The "From" column contains the Kubernetes release when a feature is introduced or its release stage is changed.The "To" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate. If the feature stage is either "Deprecated" or "GA", the "To" column is the Kubernetes release when the feature is removed.Feature Gates RemovedFeatureDefaultStageFromToAcceleratorsfalseAlpha1.61.10Accelerators–Deprecated1.111.11AdmissionWebhookMatchConditionsfalseAlpha1.271.27AdmissionWebhookMatchConditionstrueBeta1.281.29AdmissionWebhookMatchConditionstrueGA1.301.32AdvancedAuditingfalseAlpha1.71.7AdvancedAuditingtrueBeta1.81.11AdvancedAuditingtrueGA1.121.27AffinityInAnnotationsfalseAlpha1.61.7AffinityInAnnotations–Deprecated1.81.8AggregatedDiscoveryEndpointfalseAlpha1.261.26AggregatedDiscoveryEndpointtrueBeta1.271.29AggregatedDiscoveryEndpointtrueGA1.301.32AllowExtTrafficLocalEndpointsfalseBeta1.41.6AllowExtTrafficLocalEndpointstrueGA1.71.9AllowInsecureBackendProxytrueBeta1.171.20AllowInsecureBackendProxytrueGA1.211.25APIListChunkingfalseAlpha1.81.8APIListChunkingtrueBeta1.91.28APIListChunkingtrueGA1.291.32APIPriorityAndFairnessfalseAlpha1.181.19APIPriorityAndFairnesstrueBeta1.201.28APIPriorityAndFairnesstrueGA1.291.30APISelfSubjectReviewfalseAlpha1.261.26APISelfSubjectReviewtrueBeta1.271.27APISelfSubjectReviewtrueGA1.281.29AppArmortrueBeta1.41.30AppArmortrueGA1.311.32AppArmorFieldstrueBeta1.301.30AppArmorFieldstrueGA1.311.32AttachVolumeLimitfalseAlpha1.111.11AttachVolumeLimittrueBeta1.121.16AttachVolumeLimittrueGA1.171.21BalanceAttachedNodeVolumesfalseAlpha1.111.21BalanceAttachedNodeVolumesfalseDeprecated1.221.22BlockVolumefalseAlpha1.91.12BlockVolumetrueBeta1.131.17BlockVolumetrueGA1.181.21BoundServiceAccountTokenVolumefalseAlpha1.131.20BoundServiceAccountTokenVolumetrueBeta1.211.21BoundServiceAccountTokenVolumetrueGA1.221.23CloudDualStackNodeIPsfalseAlpha1.271.28CloudDualStackNodeIPstrueBeta1.291.29CloudDualStackNodeIPstrueGA1.301.31ConfigurableFSGroupPolicyfalseAlpha1.181.19ConfigurableFSGroupPolicytrueBeta1.201.22ConfigurableFSGroupPolicytrueGA1.231.25ConsistentHTTPGetHandlerstrueGA1.251.30ControllerManagerLeaderMigrationfalseAlpha1.211.21ControllerManagerLeaderMigrationtrueBeta1.221.23ControllerManagerLeaderMigrationtrueGA1.241.26CPUManagerfalseAlpha1.81.9C


Question: What are the benefits of Feature Gates (removed)?

Answer: Feature Gates (removed)This page contains list of feature gates that have been removed. The information on this page is for reference. A removed feature gate is different from a GA'ed or deprecated one in that a removed one is no longer recognized as a valid feature gate. However, a GA'ed or a deprecated feature gate is still recognized by the corresponding Kubernetes components although they are unable to cause any behavior differences in a cluster.For feature gates that are still recognized by the Kubernetes components, please refer to the Alpha/Beta feature gate table or the Graduated/Deprecated feature gate tableFeature gates that are removedIn the following table:The "From" column contains the Kubernetes release when a feature is introduced or its release stage is changed.The "To" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate. If the feature stage is either "Deprecated" or "GA", the "To" column is the Kubernetes release when the feature is removed.Feature Gates RemovedFeatureDefaultStageFromToAcceleratorsfalseAlpha1.61.10Accelerators–Deprecated1.111.11AdmissionWebhookMatchConditionsfalseAlpha1.271.27AdmissionWebhookMatchConditionstrueBeta1.281.29AdmissionWebhookMatchConditionstrueGA1.301.32AdvancedAuditingfalseAlpha1.71.7AdvancedAuditingtrueBeta1.81.11AdvancedAuditingtrueGA1.121.27AffinityInAnnotationsfalseAlpha1.61.7AffinityInAnnotations–Deprecated1.81.8AggregatedDiscoveryEndpointfalseAlpha1.261.26AggregatedDiscoveryEndpointtrueBeta1.271.29AggregatedDiscoveryEndpointtrueGA1.301.32AllowExtTrafficLocalEndpointsfalseBeta1.41.6AllowExtTrafficLocalEndpointstrueGA1.71.9AllowInsecureBackendProxytrueBeta1.171.20AllowInsecureBackendProxytrueGA1.211.25APIListChunkingfalseAlpha1.81.8APIListChunkingtrueBeta1.91.28APIListChunkingtrueGA1.291.32APIPriorityAndFairnessfalseAlpha1.181.19APIPriorityAndFairnesstrueBeta1.201.28APIPriorityAndFairnesstrueGA1.291.30APISelfSubjectReviewfalseAlpha1.261.26APISelfSubjectReviewtrueBeta1.271.27APISelfSubjectReviewtrueGA1.281.29AppArmortrueBeta1.41.30AppArmortrueGA1.311.32AppArmorFieldstrueBeta1.301.30AppArmorFieldstrueGA1.311.32AttachVolumeLimitfalseAlpha1.111.11AttachVolumeLimittrueBeta1.121.16AttachVolumeLimittrueGA1.171.21BalanceAttachedNodeVolumesfalseAlpha1.111.21BalanceAttachedNodeVolumesfalseDeprecated1.221.22BlockVolumefalseAlpha1.91.12BlockVolumetrueBeta1.131.17BlockVolumetrueGA1.181.21BoundServiceAccountTokenVolumefalseAlpha1.131.20BoundServiceAccountTokenVolumetrueBeta1.211.21BoundServiceAccountTokenVolumetrueGA1.221.23CloudDualStackNodeIPsfalseAlpha1.271.28CloudDualStackNodeIPstrueBeta1.291.29CloudDualStackNodeIPstrueGA1.301.31ConfigurableFSGroupPolicyfalseAlpha1.181.19ConfigurableFSGroupPolicytrueBeta1.201.22ConfigurableFSGroupPolicytrueGA1.231.25ConsistentHTTPGetHandlerstrueGA1.251.30ControllerManagerLeaderMigrationfalseAlpha1.211.21ControllerManagerLeaderMigrationtrueBeta1.221.23ControllerManagerLeaderMigrationtrueGA1.241.26CPUManagerfalseAlpha1.81.9C


Question: What is Feature Gates (removed)?

Answer: T h i s   p a g e   c o n t a i n s   l i s t   o f   f e a t u r e   g a t e s   t h a t   h a v e   b e e n   r e m o v e d .   T h e   i n f o r m a t i o n   o n   t h i s   p a g e   i s   f o r   r e f e r e n c e .   A   r e m o v e d   f e a t u r e   g a t e   i s   d i f f e r e n t   f r o m   a   G A ' e d   o r   d e p r e c a t e d   o n e   i n   t h a t   a   r e m o v e d   o n e   i s   n o   l o n g e r   r e c o g n i z e d   a s   a   v a l i d   f e a t u r e   g a t e .   H o w e v e r ,   a   G A ' e d   o r   a   d e p r e c a t e d   f e a t u r e   g a t e   i s   s t i l l   r e c o g n i z e d   b y   t h e   c o r r e s p o n d i n g   K u b e r n e t e s   c o m p o n e n t s   a l t h o u g h   t h e y   a r e   u n a b l e   t o   c a u s e   a n y   b e h a v i o r   d i f f e r e n c e s   i n   a   c l u s t e r .   F o r   f e a t u r e   g a t e s   t h a t   a r e   s t i l l   r e c o g n i z e d   b y   t h e   K u b e r n e t e s   c o m p o n e n t s ,   p l e a s e   r e f e r   t o   t h e   A l p h a / B e t a   f e a t u r e   g a t e   t a b l e   o r   t h e   G r a d u a t e d / D e p r e c a t e d   f e a t u r e   g a t e   t a b l e


Question: What is Feature gates that are removed?

Answer: I n   t h e   f o l l o w i n g   t a b l e :   T h e   " F r o m "   c o l u m n   c o n t a i n s   t h e   K u b e r n e t e s   r e l e a s e   w h e n   a   f e a t u r e   i s   i n t r o d u c e d   o r   i t s   r e l e a s e   s t a g e   i s   c h a n g e d . T h e   " T o "   c o l u m n ,   i f   n o t   e m p t y ,   c o n t a i n s   t h e   l a s t   K u b e r n e t e s   r e l e a s e   i n   w h i c h   y o u   c a n   s t i l l   u s e   a   f e a t u r e   g a t e .   I f   t h e   f e a t u r e   s t a g e   i s   e i t h e r   " D e p r e c a t e d "   o r   " G A " ,   t h e   " T o "   c o l u m n   i s   t h e   K u b e r n e t e s   r e l e a s e   w h e n   t h e   f e a t u r e   i s   r e m o v e d .


Question: What is Descriptions for removed feature gates?

Answer: A c c e l e r a t o r s :   P r o v i d e d   a n   e a r l y   f o r m   o f   p l u g i n   t o   e n a b l e   N v i d i a   G P U   s u p p o r t   w h e n   u s i n g   D o c k e r   E n g i n e ;   n o   l o n g e r   a v a i l a b l e .   S e e   D e v i c e   P l u g i n s   f o r   a n   a l t e r n a t i v e . A d m i s s i o n W e b h o o k M a t c h C o n d i t i o n s :   E n a b l e   m a t c h   c o n d i t i o n s   o n   m u t a t i n g   &   v a l i d a t i n g   a d m i s s i o n   w e b h o o k s . A d v a n c e d A u d i t i n g :   E n a b l e   a d v a n c e d   a u d i t i n g A f f i n i t y I n A n n o t a t i o n s :   E n a b l e   s e t t i n g   P o d   a f f i n i t y   o r   a n t i - a f f i n i t y . A g g r e g a t e d D i s c o v e r y E n d p o i n t :   E n a b l e   a   s i n g l e   H T T P   e n d p o i n t   / d i s c o v e r y / < v e r s i o n >   w h i c h   s u p p o r t s   n a t i v e   H T T P   c a c h i n g   w i t h   E T a g s   c o n t a i n i n g   a l l   A P I R e s o u r c e s   k n o w n   t o   t h e   A P I   s e r v e r . A l l o w E x t T r a f f i c L o c a l E n d p o i n t s :   E n a b l e   a   s e r v i c e   t o   r o u t e   e x t e r n a l   r e q u e s t s   t o   n o d e   l o c a l   e n d p o i n t s . A l l o w I n s e c u r e B a c k e n d P r o x y :   E n a b l e   t h e   u s e r s   t o   s k i p   T L S   v e r i f i c a t i o n   o f   k u b e l e t s   o n   P o d   l o g   r e q u e s t s . A P I L i s t C h u n k i n g :   E n a b l e   t h e   A P I   c l i e n t s   t o   r e t r i e v e   ( L I S T   o r   G E T )   r e s o u r c e s   f r o m   A P I   s e r v e r   i n   c h u n k s . A P I P r i o r i t y A n d F a i r n e s s :   E n a b l e   m a n a g i n g   r e q u e s t   c o n c u r r e n c y   w i t h   p r i o r i t i z a t i o n   a n d   f a i r n e s s   a t   e a c h   s e r v e r .   ( R e n a m e d   f r o m   R e q u e s t M a n a g e m e n t ) A P I S e l f


Question: What is kubectl completion?

Answer: kubectl completionSynopsisOutput shell completion code for the specified shell (bash, zsh, fish, or powershell). The shell code must be evaluated to provide interactive completion of kubectl commands. This can be done by sourcing it from the .bash_profile.Detailed instructions on how to do this are available here: for macOS: https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion for linux: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion for windows: https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.kubectl completion SHELL Examples # Installing bash completion on macOS using homebrew ## If running Bash 3.2 included with macOS brew install bash-completion ## or, if running Bash 4.1+ brew install bash-completion@2 ## If kubectl is installed via homebrew, this should start working immediately ## If you've installed via other means, you may need add the completion to your completion directory kubectl completion bash > $(brew --prefix)/etc/bash_completion.d/kubectl # Installing bash completion on Linux ## If bash-completion is not installed on Linux, install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell source <(kubectl completion bash) ## Write bash completion code to a file and source it from .bash_profile kubectl completion bash > ~/.kube/completion.bash.inc printf " # kubectl shell completion source '$HOME/.kube/completion.bash.inc' " >> $HOME/.bash_profile source $HOME/.bash_profile # Load the kubectl completion code for zsh[1] into the current shell source <(kubectl completion zsh) # Set the kubectl completion code for zsh[1] to autoload on startup kubectl completion zsh > "${fpath[1]}/_kubectl" # Load the kubectl completion code for fish[2] into the current shell kubectl completion fish | source # To load completions for each session, execute once: kubectl completion fish > ~/.config/fish/completions/kubectl.fish # Load the kubectl completion code for powershell into the current shell kubectl completion powershell | Out-String | Invoke-Expression # Set kubectl completion code for powershell to run on startup ## Save completion code to a script and execute in the profile kubectl completion powershell > $HOME\.kube\completion.ps1 Add-Content $PROFILE "$HOME\.kube\completion.ps1" ## Execute completion code in the profile Add-Content $PROFILE "if (Get-Command kubectl -ErrorAction SilentlyContinue) { kubectl completion powershell | Out-String | Invoke-Expression }" ## Add completion code directly to the $PROFILE script kubectl completion powershell >> $PROFILE Options-h, --helphelp for completionParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsG


Question: How does kubectl completion work?

Answer: kubectl completionSynopsisOutput shell completion code for the specified shell (bash, zsh, fish, or powershell). The shell code must be evaluated to provide interactive completion of kubectl commands. This can be done by sourcing it from the .bash_profile.Detailed instructions on how to do this are available here: for macOS: https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion for linux: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion for windows: https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.kubectl completion SHELL Examples # Installing bash completion on macOS using homebrew ## If running Bash 3.2 included with macOS brew install bash-completion ## or, if running Bash 4.1+ brew install bash-completion@2 ## If kubectl is installed via homebrew, this should start working immediately ## If you've installed via other means, you may need add the completion to your completion directory kubectl completion bash > $(brew --prefix)/etc/bash_completion.d/kubectl # Installing bash completion on Linux ## If bash-completion is not installed on Linux, install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell source <(kubectl completion bash) ## Write bash completion code to a file and source it from .bash_profile kubectl completion bash > ~/.kube/completion.bash.inc printf " # kubectl shell completion source '$HOME/.kube/completion.bash.inc' " >> $HOME/.bash_profile source $HOME/.bash_profile # Load the kubectl completion code for zsh[1] into the current shell source <(kubectl completion zsh) # Set the kubectl completion code for zsh[1] to autoload on startup kubectl completion zsh > "${fpath[1]}/_kubectl" # Load the kubectl completion code for fish[2] into the current shell kubectl completion fish | source # To load completions for each session, execute once: kubectl completion fish > ~/.config/fish/completions/kubectl.fish # Load the kubectl completion code for powershell into the current shell kubectl completion powershell | Out-String | Invoke-Expression # Set kubectl completion code for powershell to run on startup ## Save completion code to a script and execute in the profile kubectl completion powershell > $HOME\.kube\completion.ps1 Add-Content $PROFILE "$HOME\.kube\completion.ps1" ## Execute completion code in the profile Add-Content $PROFILE "if (Get-Command kubectl -ErrorAction SilentlyContinue) { kubectl completion powershell | Out-String | Invoke-Expression }" ## Add completion code directly to the $PROFILE script kubectl completion powershell >> $PROFILE Options-h, --helphelp for completionParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsG


Question: When would you use kubectl completion?

Answer: kubectl completionSynopsisOutput shell completion code for the specified shell (bash, zsh, fish, or powershell). The shell code must be evaluated to provide interactive completion of kubectl commands. This can be done by sourcing it from the .bash_profile.Detailed instructions on how to do this are available here: for macOS: https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion for linux: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion for windows: https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.kubectl completion SHELL Examples # Installing bash completion on macOS using homebrew ## If running Bash 3.2 included with macOS brew install bash-completion ## or, if running Bash 4.1+ brew install bash-completion@2 ## If kubectl is installed via homebrew, this should start working immediately ## If you've installed via other means, you may need add the completion to your completion directory kubectl completion bash > $(brew --prefix)/etc/bash_completion.d/kubectl # Installing bash completion on Linux ## If bash-completion is not installed on Linux, install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell source <(kubectl completion bash) ## Write bash completion code to a file and source it from .bash_profile kubectl completion bash > ~/.kube/completion.bash.inc printf " # kubectl shell completion source '$HOME/.kube/completion.bash.inc' " >> $HOME/.bash_profile source $HOME/.bash_profile # Load the kubectl completion code for zsh[1] into the current shell source <(kubectl completion zsh) # Set the kubectl completion code for zsh[1] to autoload on startup kubectl completion zsh > "${fpath[1]}/_kubectl" # Load the kubectl completion code for fish[2] into the current shell kubectl completion fish | source # To load completions for each session, execute once: kubectl completion fish > ~/.config/fish/completions/kubectl.fish # Load the kubectl completion code for powershell into the current shell kubectl completion powershell | Out-String | Invoke-Expression # Set kubectl completion code for powershell to run on startup ## Save completion code to a script and execute in the profile kubectl completion powershell > $HOME\.kube\completion.ps1 Add-Content $PROFILE "$HOME\.kube\completion.ps1" ## Execute completion code in the profile Add-Content $PROFILE "if (Get-Command kubectl -ErrorAction SilentlyContinue) { kubectl completion powershell | Out-String | Invoke-Expression }" ## Add completion code directly to the $PROFILE script kubectl completion powershell >> $PROFILE Options-h, --helphelp for completionParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsG


Question: What are the benefits of kubectl completion?

Answer: kubectl completionSynopsisOutput shell completion code for the specified shell (bash, zsh, fish, or powershell). The shell code must be evaluated to provide interactive completion of kubectl commands. This can be done by sourcing it from the .bash_profile.Detailed instructions on how to do this are available here: for macOS: https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion for linux: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion for windows: https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.kubectl completion SHELL Examples # Installing bash completion on macOS using homebrew ## If running Bash 3.2 included with macOS brew install bash-completion ## or, if running Bash 4.1+ brew install bash-completion@2 ## If kubectl is installed via homebrew, this should start working immediately ## If you've installed via other means, you may need add the completion to your completion directory kubectl completion bash > $(brew --prefix)/etc/bash_completion.d/kubectl # Installing bash completion on Linux ## If bash-completion is not installed on Linux, install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell source <(kubectl completion bash) ## Write bash completion code to a file and source it from .bash_profile kubectl completion bash > ~/.kube/completion.bash.inc printf " # kubectl shell completion source '$HOME/.kube/completion.bash.inc' " >> $HOME/.bash_profile source $HOME/.bash_profile # Load the kubectl completion code for zsh[1] into the current shell source <(kubectl completion zsh) # Set the kubectl completion code for zsh[1] to autoload on startup kubectl completion zsh > "${fpath[1]}/_kubectl" # Load the kubectl completion code for fish[2] into the current shell kubectl completion fish | source # To load completions for each session, execute once: kubectl completion fish > ~/.config/fish/completions/kubectl.fish # Load the kubectl completion code for powershell into the current shell kubectl completion powershell | Out-String | Invoke-Expression # Set kubectl completion code for powershell to run on startup ## Save completion code to a script and execute in the profile kubectl completion powershell > $HOME\.kube\completion.ps1 Add-Content $PROFILE "$HOME\.kube\completion.ps1" ## Execute completion code in the profile Add-Content $PROFILE "if (Get-Command kubectl -ErrorAction SilentlyContinue) { kubectl completion powershell | Out-String | Invoke-Expression }" ## Add completion code directly to the $PROFILE script kubectl completion powershell >> $PROFILE Options-h, --helphelp for completionParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsG


Question: What is Synopsis?

Answer: O u t p u t   s h e l l   c o m p l e t i o n   c o d e   f o r   t h e   s p e c i f i e d   s h e l l   ( b a s h ,   z s h ,   f i s h ,   o r   p o w e r s h e l l ) .   T h e   s h e l l   c o d e   m u s t   b e   e v a l u a t e d   t o   p r o v i d e   i n t e r a c t i v e   c o m p l e t i o n   o f   k u b e c t l   c o m m a n d s .   T h i s   c a n   b e   d o n e   b y   s o u r c i n g   i t   f r o m   t h e   . b a s h _ p r o f i l e .   D e t a i l e d   i n s t r u c t i o n s   o n   h o w   t o   d o   t h i s   a r e   a v a i l a b l e   h e r e :   f o r   m a c O S :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / t o o l s / i n s t a l l - k u b e c t l - m a c o s / # e n a b l e - s h e l l - a u t o c o m p l e t i o n   f o r   l i n u x :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / t o o l s / i n s t a l l - k u b e c t l - l i n u x / # e n a b l e - s h e l l - a u t o c o m p l e t i o n   f o r   w i n d o w s :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / t o o l s / i n s t a l l - k u b e c t l - w i n d o w s / # e n a b l e - s h e l l - a u t o c o m p l e t i o n   N o t e   f o r   z s h   u s e r s :   [ 1 ]   z s h   c o m p l e t i o n s   a r e   o n l y   s u p p o r t e d   i n   v e r s i o n s   o f   z s h   > =   5 . 2 .   k u b e c t l   c o m p l e t i o n   S H E L L


Question: What is Examples?

Answer: #   I n s t a l l i n g   b a s h   c o m p l e t i o n   o n   m a c O S   u s i n g   h o m e b r e w   # #   I f   r u n n i n g   B a s h   3 . 2   i n c l u d e d   w i t h   m a c O S   b r e w   i n s t a l l   b a s h - c o m p l e t i o n   # #   o r ,   i f   r u n n i n g   B a s h   4 . 1 +   b r e w   i n s t a l l   b a s h - c o m p l e t i o n @ 2   # #   I f   k u b e c t l   i s   i n s t a l l e d   v i a   h o m e b r e w ,   t h i s   s h o u l d   s t a r t   w o r k i n g   i m m e d i a t e l y   # #   I f   y o u ' v e   i n s t a l l e d   v i a   o t h e r   m e a n s ,   y o u   m a y   n e e d   a d d   t h e   c o m p l e t i o n   t o   y o u r   c o m p l e t i o n   d i r e c t o r y   k u b e c t l   c o m p l e t i o n   b a s h   >   $ ( b r e w   - - p r e f i x ) / e t c / b a s h _ c o m p l e t i o n . d / k u b e c t l   #   I n s t a l l i n g   b a s h   c o m p l e t i o n   o n   L i n u x   # #   I f   b a s h - c o m p l e t i o n   i s   n o t   i n s t a l l e d   o n   L i n u x ,   i n s t a l l   t h e   ' b a s h - c o m p l e t i o n '   p a c k a g e   # #   v i a   y o u r   d i s t r i b u t i o n ' s   p a c k a g e   m a n a g e r .   # #   L o a d   t h e   k u b e c t l   c o m p l e t i o n   c o d e   f o r   b a s h   i n t o   t h e   c u r r e n t   s h e l l   s o u r c e   < ( k u b e c t l   c o m p l e t i o n   b a s h )   # #   W r i t e   b a s h   c o m p l e t i o n   c o d e   t o   a   f i l e   a n d   s o u r c e   i t   f r o m   . b a s h _ p r o f i l e   k u b e c t l   c o m p l e t i o n   b a s h   >   ~ / . k u b e / c o m p l e t i o n . b a s h . i n c   p r i n t f   "   #   k u b e c t l   s h e l l   c o m p l e t i o n   s o u r c e   ' $ H O M E / . k u b e / c o m p l e t i o n . b a s h . i n c '   "   > >   $ H O M E / . b a s h _ p r o f i l e   s o u r c e   $ H O M E / . b a s h _ p r o f i l e   #   L o a d   t h e   k u b e c t l   c o m p l e t i o n   c o d e   f


Question: What is Options?

Answer: h e l p   f o r   c o m p l e t i o n


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   -   k u b e c t l   c o n t r o l s   t h e   K u b e r n e t e s   c l u s t e r   m a n a g e r   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Pod Overhead?

Answer: Pod OverheadFEATURE STATE: Kubernetes v1.24 [stable]When you run a Pod on a Node, the Pod itself takes an amount of system resources. These resources are additional to the resources needed to run the container(s) inside the Pod. In Kubernetes, Pod Overhead is a way to account for the resources consumed by the Pod infrastructure on top of the container requests & limits.In Kubernetes, the Pod's overhead is set at admission time according to the overhead associated with the Pod's RuntimeClass.A pod's overhead is considered in addition to the sum of container resource requests when scheduling a Pod. Similarly, the kubelet will include the Pod overhead when sizing the Pod cgroup, and when carrying out Pod eviction ranking.Configuring Pod overheadYou need to make sure a RuntimeClass is utilized which defines the overhead field.Usage exampleTo work with Pod overhead, you need a RuntimeClass that defines the overhead field. As an example, you could use the following RuntimeClass definition with a virtualization container runtime (in this example, Kata Containers combined with the Firecracker virtual machine monitor) that uses around 120MiB per Pod for the virtual machine and the guest OS:# You need to change this example to match the actual runtime name, and per-Pod # resource overhead, that the container runtime is adding in your cluster. apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: kata-fc handler: kata-fc overhead: podFixed: memory: "120Mi" cpu: "250m" Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup sizing.Consider running the given example workload, test-pod:apiVersion: v1 kind: Pod metadata: name: test-pod spec: runtimeClassName: kata-fc containers: - name: busybox-ctr image: busybox:1.28 stdin: true tty: true resources: limits: cpu: 500m memory: 100Mi - name: nginx-ctr image: nginx resources: limits: cpu: 1500m memory: 100Mi Note:If only limits are specified in the pod definition, kubelet will deduce requests from those limits and set them to be the same as the defined limits.At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod will be rejected. In the given example, since only the RuntimeClass name is specified, the admission controller mutates the Pod to include an overhead.After the RuntimeClass admission controller has made modifications, you can check the updated Pod overhead value:kubectl get pod test-pod -o jsonpath='{.spec.overhead}' The output is:map[cpu:250m memory:120Mi] If a ResourceQuota is defined, the sum of container requests as well as the overhead field are counted.When the kube-scheduler is deciding which node should run a new Pod, the scheduler considers that Pod's overhead as well as the sum of container requests for


Question: How does Pod Overhead work?

Answer: Pod OverheadFEATURE STATE: Kubernetes v1.24 [stable]When you run a Pod on a Node, the Pod itself takes an amount of system resources. These resources are additional to the resources needed to run the container(s) inside the Pod. In Kubernetes, Pod Overhead is a way to account for the resources consumed by the Pod infrastructure on top of the container requests & limits.In Kubernetes, the Pod's overhead is set at admission time according to the overhead associated with the Pod's RuntimeClass.A pod's overhead is considered in addition to the sum of container resource requests when scheduling a Pod. Similarly, the kubelet will include the Pod overhead when sizing the Pod cgroup, and when carrying out Pod eviction ranking.Configuring Pod overheadYou need to make sure a RuntimeClass is utilized which defines the overhead field.Usage exampleTo work with Pod overhead, you need a RuntimeClass that defines the overhead field. As an example, you could use the following RuntimeClass definition with a virtualization container runtime (in this example, Kata Containers combined with the Firecracker virtual machine monitor) that uses around 120MiB per Pod for the virtual machine and the guest OS:# You need to change this example to match the actual runtime name, and per-Pod # resource overhead, that the container runtime is adding in your cluster. apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: kata-fc handler: kata-fc overhead: podFixed: memory: "120Mi" cpu: "250m" Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup sizing.Consider running the given example workload, test-pod:apiVersion: v1 kind: Pod metadata: name: test-pod spec: runtimeClassName: kata-fc containers: - name: busybox-ctr image: busybox:1.28 stdin: true tty: true resources: limits: cpu: 500m memory: 100Mi - name: nginx-ctr image: nginx resources: limits: cpu: 1500m memory: 100Mi Note:If only limits are specified in the pod definition, kubelet will deduce requests from those limits and set them to be the same as the defined limits.At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod will be rejected. In the given example, since only the RuntimeClass name is specified, the admission controller mutates the Pod to include an overhead.After the RuntimeClass admission controller has made modifications, you can check the updated Pod overhead value:kubectl get pod test-pod -o jsonpath='{.spec.overhead}' The output is:map[cpu:250m memory:120Mi] If a ResourceQuota is defined, the sum of container requests as well as the overhead field are counted.When the kube-scheduler is deciding which node should run a new Pod, the scheduler considers that Pod's overhead as well as the sum of container requests for


Question: When would you use Pod Overhead?

Answer: Pod OverheadFEATURE STATE: Kubernetes v1.24 [stable]When you run a Pod on a Node, the Pod itself takes an amount of system resources. These resources are additional to the resources needed to run the container(s) inside the Pod. In Kubernetes, Pod Overhead is a way to account for the resources consumed by the Pod infrastructure on top of the container requests & limits.In Kubernetes, the Pod's overhead is set at admission time according to the overhead associated with the Pod's RuntimeClass.A pod's overhead is considered in addition to the sum of container resource requests when scheduling a Pod. Similarly, the kubelet will include the Pod overhead when sizing the Pod cgroup, and when carrying out Pod eviction ranking.Configuring Pod overheadYou need to make sure a RuntimeClass is utilized which defines the overhead field.Usage exampleTo work with Pod overhead, you need a RuntimeClass that defines the overhead field. As an example, you could use the following RuntimeClass definition with a virtualization container runtime (in this example, Kata Containers combined with the Firecracker virtual machine monitor) that uses around 120MiB per Pod for the virtual machine and the guest OS:# You need to change this example to match the actual runtime name, and per-Pod # resource overhead, that the container runtime is adding in your cluster. apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: kata-fc handler: kata-fc overhead: podFixed: memory: "120Mi" cpu: "250m" Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup sizing.Consider running the given example workload, test-pod:apiVersion: v1 kind: Pod metadata: name: test-pod spec: runtimeClassName: kata-fc containers: - name: busybox-ctr image: busybox:1.28 stdin: true tty: true resources: limits: cpu: 500m memory: 100Mi - name: nginx-ctr image: nginx resources: limits: cpu: 1500m memory: 100Mi Note:If only limits are specified in the pod definition, kubelet will deduce requests from those limits and set them to be the same as the defined limits.At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod will be rejected. In the given example, since only the RuntimeClass name is specified, the admission controller mutates the Pod to include an overhead.After the RuntimeClass admission controller has made modifications, you can check the updated Pod overhead value:kubectl get pod test-pod -o jsonpath='{.spec.overhead}' The output is:map[cpu:250m memory:120Mi] If a ResourceQuota is defined, the sum of container requests as well as the overhead field are counted.When the kube-scheduler is deciding which node should run a new Pod, the scheduler considers that Pod's overhead as well as the sum of container requests for


Question: What are the benefits of Pod Overhead?

Answer: Pod OverheadFEATURE STATE: Kubernetes v1.24 [stable]When you run a Pod on a Node, the Pod itself takes an amount of system resources. These resources are additional to the resources needed to run the container(s) inside the Pod. In Kubernetes, Pod Overhead is a way to account for the resources consumed by the Pod infrastructure on top of the container requests & limits.In Kubernetes, the Pod's overhead is set at admission time according to the overhead associated with the Pod's RuntimeClass.A pod's overhead is considered in addition to the sum of container resource requests when scheduling a Pod. Similarly, the kubelet will include the Pod overhead when sizing the Pod cgroup, and when carrying out Pod eviction ranking.Configuring Pod overheadYou need to make sure a RuntimeClass is utilized which defines the overhead field.Usage exampleTo work with Pod overhead, you need a RuntimeClass that defines the overhead field. As an example, you could use the following RuntimeClass definition with a virtualization container runtime (in this example, Kata Containers combined with the Firecracker virtual machine monitor) that uses around 120MiB per Pod for the virtual machine and the guest OS:# You need to change this example to match the actual runtime name, and per-Pod # resource overhead, that the container runtime is adding in your cluster. apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: kata-fc handler: kata-fc overhead: podFixed: memory: "120Mi" cpu: "250m" Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup sizing.Consider running the given example workload, test-pod:apiVersion: v1 kind: Pod metadata: name: test-pod spec: runtimeClassName: kata-fc containers: - name: busybox-ctr image: busybox:1.28 stdin: true tty: true resources: limits: cpu: 500m memory: 100Mi - name: nginx-ctr image: nginx resources: limits: cpu: 1500m memory: 100Mi Note:If only limits are specified in the pod definition, kubelet will deduce requests from those limits and set them to be the same as the defined limits.At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod will be rejected. In the given example, since only the RuntimeClass name is specified, the admission controller mutates the Pod to include an overhead.After the RuntimeClass admission controller has made modifications, you can check the updated Pod overhead value:kubectl get pod test-pod -o jsonpath='{.spec.overhead}' The output is:map[cpu:250m memory:120Mi] If a ResourceQuota is defined, the sum of container requests as well as the overhead field are counted.When the kube-scheduler is deciding which node should run a new Pod, the scheduler considers that Pod's overhead as well as the sum of container requests for


Question: What is Pod Overhead?

Answer: W h e n   y o u   r u n   a   P o d   o n   a   N o d e ,   t h e   P o d   i t s e l f   t a k e s   a n   a m o u n t   o f   s y s t e m   r e s o u r c e s .   T h e s e   r e s o u r c e s   a r e   a d d i t i o n a l   t o   t h e   r e s o u r c e s   n e e d e d   t o   r u n   t h e   c o n t a i n e r ( s )   i n s i d e   t h e   P o d .   I n   K u b e r n e t e s ,   P o d   O v e r h e a d   i s   a   w a y   t o   a c c o u n t   f o r   t h e   r e s o u r c e s   c o n s u m e d   b y   t h e   P o d   i n f r a s t r u c t u r e   o n   t o p   o f   t h e   c o n t a i n e r   r e q u e s t s   &   l i m i t s .   I n   K u b e r n e t e s ,   t h e   P o d ' s   o v e r h e a d   i s   s e t   a t   a d m i s s i o n   t i m e   a c c o r d i n g   t o   t h e   o v e r h e a d   a s s o c i a t e d   w i t h   t h e   P o d ' s   R u n t i m e C l a s s .   A   p o d ' s   o v e r h e a d   i s   c o n s i d e r e d   i n   a d d i t i o n   t o   t h e   s u m   o f   c o n t a i n e r   r e s o u r c e   r e q u e s t s   w h e n   s c h e d u l i n g   a   P o d .   S i m i l a r l y ,   t h e   k u b e l e t   w i l l   i n c l u d e   t h e   P o d   o v e r h e a d   w h e n   s i z i n g   t h e   P o d   c g r o u p ,   a n d   w h e n   c a r r y i n g   o u t   P o d   e v i c t i o n   r a n k i n g .


Question: What is Configuring Pod overhead?

Answer: Y o u   n e e d   t o   m a k e   s u r e   a   R u n t i m e C l a s s   i s   u t i l i z e d   w h i c h   d e f i n e s   t h e   o v e r h e a d   f i e l d .


Question: What is Usage example?

Answer: T o   w o r k   w i t h   P o d   o v e r h e a d ,   y o u   n e e d   a   R u n t i m e C l a s s   t h a t   d e f i n e s   t h e   o v e r h e a d   f i e l d .   A s   a n   e x a m p l e ,   y o u   c o u l d   u s e   t h e   f o l l o w i n g   R u n t i m e C l a s s   d e f i n i t i o n   w i t h   a   v i r t u a l i z a t i o n   c o n t a i n e r   r u n t i m e   ( i n   t h i s   e x a m p l e ,   K a t a   C o n t a i n e r s   c o m b i n e d   w i t h   t h e   F i r e c r a c k e r   v i r t u a l   m a c h i n e   m o n i t o r )   t h a t   u s e s   a r o u n d   1 2 0 M i B   p e r   P o d   f o r   t h e   v i r t u a l   m a c h i n e   a n d   t h e   g u e s t   O S :   #   Y o u   n e e d   t o   c h a n g e   t h i s   e x a m p l e   t o   m a t c h   t h e   a c t u a l   r u n t i m e   n a m e ,   a n d   p e r - P o d   #   r e s o u r c e   o v e r h e a d ,   t h a t   t h e   c o n t a i n e r   r u n t i m e   i s   a d d i n g   i n   y o u r   c l u s t e r .   a p i V e r s i o n :   n o d e . k 8 s . i o / v 1   k i n d :   R u n t i m e C l a s s   m e t a d a t a :   n a m e :   k a t a - f c   h a n d l e r :   k a t a - f c   o v e r h e a d :   p o d F i x e d :   m e m o r y :   " 1 2 0 M i "   c p u :   " 2 5 0 m "   W o r k l o a d s   w h i c h   a r e   c r e a t e d   w h i c h   s p e c i f y   t h e   k a t a - f c   R u n t i m e C l a s s   h a n d l e r   w i l l   t a k e   t h e   m e m o r y   a n d   c p u   o v e r h e a d s   i n t o   a c c o u n t   f o r   r e s o u r c e   q u o t a   c a l c u l a t i o n s ,   n o d e   s c h e d u l i n g ,   a s   w e l l   a s   P o d   c g r o u p   s i z i n g .   C o n s i d e r   r u n n i n g   t h e   g i v e n   e x a m p l e   w o r k l o a d ,   t e s t - p o d :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - p o d   s p e c :   r u n t i m e C l a s s N a m e :   k a t a - f c   c o n t a i n e r s :


Question: What is Note:?

Answer: A t   a d m i s s i o n   t i m e   t h e   R u n t i m e C l a s s   a d m i s s i o n   c o n t r o l l e r   u p d a t e s   t h e   w o r k l o a d ' s   P o d S p e c   t o   i n c l u d e   t h e   o v e r h e a d   a s   d e s c r i b e d   i n   t h e   R u n t i m e C l a s s .   I f   t h e   P o d S p e c   a l r e a d y   h a s   t h i s   f i e l d   d e f i n e d ,   t h e   P o d   w i l l   b e   r e j e c t e d .   I n   t h e   g i v e n   e x a m p l e ,   s i n c e   o n l y   t h e   R u n t i m e C l a s s   n a m e   i s   s p e c i f i e d ,   t h e   a d m i s s i o n   c o n t r o l l e r   m u t a t e s   t h e   P o d   t o   i n c l u d e   a n   o v e r h e a d .   A f t e r   t h e   R u n t i m e C l a s s   a d m i s s i o n   c o n t r o l l e r   h a s   m a d e   m o d i f i c a t i o n s ,   y o u   c a n   c h e c k   t h e   u p d a t e d   P o d   o v e r h e a d   v a l u e :   k u b e c t l   g e t   p o d   t e s t - p o d   - o   j s o n p a t h = ' { . s p e c . o v e r h e a d } '   T h e   o u t p u t   i s :   m a p [ c p u : 2 5 0 m   m e m o r y : 1 2 0 M i ]   I f   a   R e s o u r c e Q u o t a   i s   d e f i n e d ,   t h e   s u m   o f   c o n t a i n e r   r e q u e s t s   a s   w e l l   a s   t h e   o v e r h e a d   f i e l d   a r e   c o u n t e d .   W h e n   t h e   k u b e - s c h e d u l e r   i s   d e c i d i n g   w h i c h   n o d e   s h o u l d   r u n   a   n e w   P o d ,   t h e   s c h e d u l e r   c o n s i d e r s   t h a t   P o d ' s   o v e r h e a d   a s   w e l l   a s   t h e   s u m   o f   c o n t a i n e r   r e q u e s t s   f o r   t h a t   P o d .   F o r   t h i s   e x a m p l e ,   t h e   s c h e d u l e r   a d d s   t h e   r e q u e s t s   a n d   t h e   o v e r h e a d ,   t h e n   l o o k s   f o r   a   n o d e   t h a t   h a s   2 . 2 5   C P U   a n d   3 2 0   M i B   o f   m e m o r y   a v a i l a b l e .   O n c e   a   P o d   i s   s c h e d u l e d


Question: What is Verify Pod cgroup limits?

Answer: C h e c k   t h e   P o d ' s   m e m o r y   c g r o u p s   o n   t h e   n o d e   w h e r e   t h e   w o r k l o a d   i s   r u n n i n g .   I n   t h e   f o l l o w i n g   e x a m p l e ,   c r i c t l   i s   u s e d   o n   t h e   n o d e ,   w h i c h   p r o v i d e s   a   C L I   f o r   C R I - c o m p a t i b l e   c o n t a i n e r   r u n t i m e s .   T h i s   i s   a n   a d v a n c e d   e x a m p l e   t o   s h o w   P o d   o v e r h e a d   b e h a v i o r ,   a n d   i t   i s   n o t   e x p e c t e d   t h a t   u s e r s   s h o u l d   n e e d   t o   c h e c k   c g r o u p s   d i r e c t l y   o n   t h e   n o d e .   F i r s t ,   o n   t h e   p a r t i c u l a r   n o d e ,   d e t e r m i n e   t h e   P o d   i d e n t i f i e r :   #   R u n   t h i s   o n   t h e   n o d e   w h e r e   t h e   P o d   i s   s c h e d u l e d   P O D _ I D = " $ ( s u d o   c r i c t l   p o d s   - - n a m e   t e s t - p o d   - q ) "   F r o m   t h i s ,   y o u   c a n   d e t e r m i n e   t h e   c g r o u p   p a t h   f o r   t h e   P o d :   #   R u n   t h i s   o n   t h e   n o d e   w h e r e   t h e   P o d   i s   s c h e d u l e d   s u d o   c r i c t l   i n s p e c t p   - o = j s o n   $ P O D _ I D   |   g r e p   c g r o u p s P a t h   T h e   r e s u l t i n g   c g r o u p   p a t h   i n c l u d e s   t h e   P o d ' s   p a u s e   c o n t a i n e r .   T h e   P o d   l e v e l   c g r o u p   i s   o n e   d i r e c t o r y   a b o v e .   " c g r o u p s P a t h " :   " / k u b e p o d s / p o d d 7 f 4 b 5 0 9 - c f 9 4 - 4 9 5 1 - 9 4 1 7 - d 1 0 8 7 c 9 2 a 5 b 2 / 7 c c f 5 5 a e e 3 5 d d 1 6 a c a 4 1 8 9 c 9 5 2 d 8 3 4 8 7 2 9 7 f 3 c d 7 6 0 f 1 b b f 0 9 6 2 0 e 2 0 6 e 7 d 0 c 2 7 a "   I n   t h i s   s p e c i f i c   c a s e ,   t h e   p o d   c g r o u p   p a t h   i s   k u b e p o d s / p o d d 7 f 4 b 5 0 9 - c f 9 4 - 4 9 5 1 - 9 4 1 7 - d 1 0 8 7 c 9 2 a 5 b 2 .   V e r i f y   t h e


Question: What is Observability?

Answer: S o m e   k u b e _ p o d _ o v e r h e a d _ *   m e t r i c s   a r e   a v a i l a b l e   i n   k u b e - s t a t e - m e t r i c s   t o   h e l p   i d e n t i f y   w h e n   P o d   o v e r h e a d   i s   b e i n g   u t i l i z e d   a n d   t o   h e l p   o b s e r v e   s t a b i l i t y   o f   w o r k l o a d s   r u n n i n g   w i t h   a   d e f i n e d   o v e r h e a d .


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   R u n t i m e C l a s s R e a d   t h e   P o d O v e r h e a d   D e s i g n   e n h a n c e m e n t   p r o p o s a l   f o r   e x t r a   c o n t e x t


Question: What is Restrict a Container's Syscalls with seccomp?

Answer: Restrict a Container's Syscalls with seccompFEATURE STATE: Kubernetes v1.19 [stable]Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a node to your Pods and containers.Identifying the privileges required for your workloads can be difficult. In this tutorial, you will go through how to load seccomp profiles into a local Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft profiles that give only the necessary privileges to your container processes.ObjectivesLearn how to load seccomp profiles on a nodeLearn how to apply a seccomp profile to a containerObserve auditing of syscalls made by a container processObserve behavior when a missing profile is specifiedObserve a violation of a seccomp profileLearn how to create fine-grained seccomp profilesLearn how to apply a container runtime default seccomp profileBefore you beginIn order to complete all steps in this tutorial, you must install kind and kubectl.The commands used in the tutorial assume that you are using Docker as your container runtime. (The cluster that kind creates may use a different container runtime internally). You could also use Podman but in that case, you would have to follow specific instructions in order to complete the tasks successfully.This tutorial shows some examples that are still beta (since v1.25) and others that use only generally available seccomp functionality. You should make sure that your cluster is configured correctly for the version you are using.The tutorial also uses the curl tool for downloading examples to your computer. You can adapt the steps to use a different tool if you prefer.Note:It is not possible to apply a seccomp profile to a container running with privileged: true set in the container's securityContext. Privileged containers always run as Unconfined.Download example seccomp profilesThe contents of these profiles will be explored later on, but for now go ahead and download them into a directory named profiles/ so that they can be loaded into the cluster.pods/security/seccomp/profiles/audit.json { "defaultAction": "SCMP_ACT_LOG" }pods/security/seccomp/profiles/violation.json { "defaultAction": "SCMP_ACT_ERRNO" }pods/security/seccomp/profiles/fine-grained.json { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], "syscalls": [ { "names": [ "accept4", "epoll_wait", "pselect6", "futex", "madvise", "epoll_ctl", "getsockname", "setsockopt", "vfork", "mmap", "read", "write", "close", "arch_prctl", "sched_getaffinity", "munmap", "brk", "rt_sigaction", "rt_sigprocmask", "sigaltstack", "gettid", "clone", "bind", "socket", "openat", "readlinkat", "exit_group", "epoll_create1", "listen", "rt_sigreturn", "sched_yield", "clock_get


Question: How does Restrict a Container's Syscalls with seccomp work?

Answer: Restrict a Container's Syscalls with seccompFEATURE STATE: Kubernetes v1.19 [stable]Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a node to your Pods and containers.Identifying the privileges required for your workloads can be difficult. In this tutorial, you will go through how to load seccomp profiles into a local Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft profiles that give only the necessary privileges to your container processes.ObjectivesLearn how to load seccomp profiles on a nodeLearn how to apply a seccomp profile to a containerObserve auditing of syscalls made by a container processObserve behavior when a missing profile is specifiedObserve a violation of a seccomp profileLearn how to create fine-grained seccomp profilesLearn how to apply a container runtime default seccomp profileBefore you beginIn order to complete all steps in this tutorial, you must install kind and kubectl.The commands used in the tutorial assume that you are using Docker as your container runtime. (The cluster that kind creates may use a different container runtime internally). You could also use Podman but in that case, you would have to follow specific instructions in order to complete the tasks successfully.This tutorial shows some examples that are still beta (since v1.25) and others that use only generally available seccomp functionality. You should make sure that your cluster is configured correctly for the version you are using.The tutorial also uses the curl tool for downloading examples to your computer. You can adapt the steps to use a different tool if you prefer.Note:It is not possible to apply a seccomp profile to a container running with privileged: true set in the container's securityContext. Privileged containers always run as Unconfined.Download example seccomp profilesThe contents of these profiles will be explored later on, but for now go ahead and download them into a directory named profiles/ so that they can be loaded into the cluster.pods/security/seccomp/profiles/audit.json { "defaultAction": "SCMP_ACT_LOG" }pods/security/seccomp/profiles/violation.json { "defaultAction": "SCMP_ACT_ERRNO" }pods/security/seccomp/profiles/fine-grained.json { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], "syscalls": [ { "names": [ "accept4", "epoll_wait", "pselect6", "futex", "madvise", "epoll_ctl", "getsockname", "setsockopt", "vfork", "mmap", "read", "write", "close", "arch_prctl", "sched_getaffinity", "munmap", "brk", "rt_sigaction", "rt_sigprocmask", "sigaltstack", "gettid", "clone", "bind", "socket", "openat", "readlinkat", "exit_group", "epoll_create1", "listen", "rt_sigreturn", "sched_yield", "clock_get


Question: When would you use Restrict a Container's Syscalls with seccomp?

Answer: Restrict a Container's Syscalls with seccompFEATURE STATE: Kubernetes v1.19 [stable]Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a node to your Pods and containers.Identifying the privileges required for your workloads can be difficult. In this tutorial, you will go through how to load seccomp profiles into a local Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft profiles that give only the necessary privileges to your container processes.ObjectivesLearn how to load seccomp profiles on a nodeLearn how to apply a seccomp profile to a containerObserve auditing of syscalls made by a container processObserve behavior when a missing profile is specifiedObserve a violation of a seccomp profileLearn how to create fine-grained seccomp profilesLearn how to apply a container runtime default seccomp profileBefore you beginIn order to complete all steps in this tutorial, you must install kind and kubectl.The commands used in the tutorial assume that you are using Docker as your container runtime. (The cluster that kind creates may use a different container runtime internally). You could also use Podman but in that case, you would have to follow specific instructions in order to complete the tasks successfully.This tutorial shows some examples that are still beta (since v1.25) and others that use only generally available seccomp functionality. You should make sure that your cluster is configured correctly for the version you are using.The tutorial also uses the curl tool for downloading examples to your computer. You can adapt the steps to use a different tool if you prefer.Note:It is not possible to apply a seccomp profile to a container running with privileged: true set in the container's securityContext. Privileged containers always run as Unconfined.Download example seccomp profilesThe contents of these profiles will be explored later on, but for now go ahead and download them into a directory named profiles/ so that they can be loaded into the cluster.pods/security/seccomp/profiles/audit.json { "defaultAction": "SCMP_ACT_LOG" }pods/security/seccomp/profiles/violation.json { "defaultAction": "SCMP_ACT_ERRNO" }pods/security/seccomp/profiles/fine-grained.json { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], "syscalls": [ { "names": [ "accept4", "epoll_wait", "pselect6", "futex", "madvise", "epoll_ctl", "getsockname", "setsockopt", "vfork", "mmap", "read", "write", "close", "arch_prctl", "sched_getaffinity", "munmap", "brk", "rt_sigaction", "rt_sigprocmask", "sigaltstack", "gettid", "clone", "bind", "socket", "openat", "readlinkat", "exit_group", "epoll_create1", "listen", "rt_sigreturn", "sched_yield", "clock_get


Question: What are the benefits of Restrict a Container's Syscalls with seccomp?

Answer: Restrict a Container's Syscalls with seccompFEATURE STATE: Kubernetes v1.19 [stable]Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a node to your Pods and containers.Identifying the privileges required for your workloads can be difficult. In this tutorial, you will go through how to load seccomp profiles into a local Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft profiles that give only the necessary privileges to your container processes.ObjectivesLearn how to load seccomp profiles on a nodeLearn how to apply a seccomp profile to a containerObserve auditing of syscalls made by a container processObserve behavior when a missing profile is specifiedObserve a violation of a seccomp profileLearn how to create fine-grained seccomp profilesLearn how to apply a container runtime default seccomp profileBefore you beginIn order to complete all steps in this tutorial, you must install kind and kubectl.The commands used in the tutorial assume that you are using Docker as your container runtime. (The cluster that kind creates may use a different container runtime internally). You could also use Podman but in that case, you would have to follow specific instructions in order to complete the tasks successfully.This tutorial shows some examples that are still beta (since v1.25) and others that use only generally available seccomp functionality. You should make sure that your cluster is configured correctly for the version you are using.The tutorial also uses the curl tool for downloading examples to your computer. You can adapt the steps to use a different tool if you prefer.Note:It is not possible to apply a seccomp profile to a container running with privileged: true set in the container's securityContext. Privileged containers always run as Unconfined.Download example seccomp profilesThe contents of these profiles will be explored later on, but for now go ahead and download them into a directory named profiles/ so that they can be loaded into the cluster.pods/security/seccomp/profiles/audit.json { "defaultAction": "SCMP_ACT_LOG" }pods/security/seccomp/profiles/violation.json { "defaultAction": "SCMP_ACT_ERRNO" }pods/security/seccomp/profiles/fine-grained.json { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], "syscalls": [ { "names": [ "accept4", "epoll_wait", "pselect6", "futex", "madvise", "epoll_ctl", "getsockname", "setsockopt", "vfork", "mmap", "read", "write", "close", "arch_prctl", "sched_getaffinity", "munmap", "brk", "rt_sigaction", "rt_sigprocmask", "sigaltstack", "gettid", "clone", "bind", "socket", "openat", "readlinkat", "exit_group", "epoll_create1", "listen", "rt_sigreturn", "sched_yield", "clock_get


Question: What is Restrict a Container's Syscalls with seccomp?

Answer: S e c c o m p   s t a n d s   f o r   s e c u r e   c o m p u t i n g   m o d e   a n d   h a s   b e e n   a   f e a t u r e   o f   t h e   L i n u x   k e r n e l   s i n c e   v e r s i o n   2 . 6 . 1 2 .   I t   c a n   b e   u s e d   t o   s a n d b o x   t h e   p r i v i l e g e s   o f   a   p r o c e s s ,   r e s t r i c t i n g   t h e   c a l l s   i t   i s   a b l e   t o   m a k e   f r o m   u s e r s p a c e   i n t o   t h e   k e r n e l .   K u b e r n e t e s   l e t s   y o u   a u t o m a t i c a l l y   a p p l y   s e c c o m p   p r o f i l e s   l o a d e d   o n t o   a   n o d e   t o   y o u r   P o d s   a n d   c o n t a i n e r s .   I d e n t i f y i n g   t h e   p r i v i l e g e s   r e q u i r e d   f o r   y o u r   w o r k l o a d s   c a n   b e   d i f f i c u l t .   I n   t h i s   t u t o r i a l ,   y o u   w i l l   g o   t h r o u g h   h o w   t o   l o a d   s e c c o m p   p r o f i l e s   i n t o   a   l o c a l   K u b e r n e t e s   c l u s t e r ,   h o w   t o   a p p l y   t h e m   t o   a   P o d ,   a n d   h o w   y o u   c a n   b e g i n   t o   c r a f t   p r o f i l e s   t h a t   g i v e   o n l y   t h e   n e c e s s a r y   p r i v i l e g e s   t o   y o u r   c o n t a i n e r   p r o c e s s e s .


Question: What is Objectives?

Answer: L e a r n   h o w   t o   l o a d   s e c c o m p   p r o f i l e s   o n   a   n o d e L e a r n   h o w   t o   a p p l y   a   s e c c o m p   p r o f i l e   t o   a   c o n t a i n e r O b s e r v e   a u d i t i n g   o f   s y s c a l l s   m a d e   b y   a   c o n t a i n e r   p r o c e s s O b s e r v e   b e h a v i o r   w h e n   a   m i s s i n g   p r o f i l e   i s   s p e c i f i e d O b s e r v e   a   v i o l a t i o n   o f   a   s e c c o m p   p r o f i l e L e a r n   h o w   t o   c r e a t e   f i n e - g r a i n e d   s e c c o m p   p r o f i l e s L e a r n   h o w   t o   a p p l y   a   c o n t a i n e r   r u n t i m e   d e f a u l t   s e c c o m p   p r o f i l e


Question: What is Before you begin?

Answer: I n   o r d e r   t o   c o m p l e t e   a l l   s t e p s   i n   t h i s   t u t o r i a l ,   y o u   m u s t   i n s t a l l   k i n d   a n d   k u b e c t l .   T h e   c o m m a n d s   u s e d   i n   t h e   t u t o r i a l   a s s u m e   t h a t   y o u   a r e   u s i n g   D o c k e r   a s   y o u r   c o n t a i n e r   r u n t i m e .   ( T h e   c l u s t e r   t h a t   k i n d   c r e a t e s   m a y   u s e   a   d i f f e r e n t   c o n t a i n e r   r u n t i m e   i n t e r n a l l y ) .   Y o u   c o u l d   a l s o   u s e   P o d m a n   b u t   i n   t h a t   c a s e ,   y o u   w o u l d   h a v e   t o   f o l l o w   s p e c i f i c   i n s t r u c t i o n s   i n   o r d e r   t o   c o m p l e t e   t h e   t a s k s   s u c c e s s f u l l y .   T h i s   t u t o r i a l   s h o w s   s o m e   e x a m p l e s   t h a t   a r e   s t i l l   b e t a   ( s i n c e   v 1 . 2 5 )   a n d   o t h e r s   t h a t   u s e   o n l y   g e n e r a l l y   a v a i l a b l e   s e c c o m p   f u n c t i o n a l i t y .   Y o u   s h o u l d   m a k e   s u r e   t h a t   y o u r   c l u s t e r   i s   c o n f i g u r e d   c o r r e c t l y   f o r   t h e   v e r s i o n   y o u   a r e   u s i n g .   T h e   t u t o r i a l   a l s o   u s e s   t h e   c u r l   t o o l   f o r   d o w n l o a d i n g   e x a m p l e s   t o   y o u r   c o m p u t e r .   Y o u   c a n   a d a p t   t h e   s t e p s   t o   u s e   a   d i f f e r e n t   t o o l   i f   y o u   p r e f e r .


Question: What is Download example seccomp profiles?

Answer: T h e   c o n t e n t s   o f   t h e s e   p r o f i l e s   w i l l   b e   e x p l o r e d   l a t e r   o n ,   b u t   f o r   n o w   g o   a h e a d   a n d   d o w n l o a d   t h e m   i n t o   a   d i r e c t o r y   n a m e d   p r o f i l e s /   s o   t h a t   t h e y   c a n   b e   l o a d e d   i n t o   t h e   c l u s t e r .   p o d s / s e c u r i t y / s e c c o m p / p r o f i l e s / a u d i t . j s o n   {   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ L O G "   }   {   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ L O G "   }   p o d s / s e c u r i t y / s e c c o m p / p r o f i l e s / v i o l a t i o n . j s o n   {   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ E R R N O "   }   {   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ E R R N O "   }   p o d s / s e c u r i t y / s e c c o m p / p r o f i l e s / f i n e - g r a i n e d . j s o n   {   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ E R R N O " ,   " a r c h i t e c t u r e s " :   [   " S C M P _ A R C H _ X 8 6 _ 6 4 " ,   " S C M P _ A R C H _ X 8 6 " ,   " S C M P _ A R C H _ X 3 2 "   ] ,   " s y s c a l l s " :   [   {   " n a m e s " :   [   " a c c e p t 4 " ,   " e p o l l _ w a i t " ,   " p s e l e c t 6 " ,   " f u t e x " ,   " m a d v i s e " ,   " e p o l l _ c t l " ,   " g e t s o c k n a m e " ,   " s e t s o c k o p t " ,   " v f o r k " ,   " m m a p " ,   " r e a d " ,   " w r i t e " ,   " c l o s e " ,   " a r c h _ p r c t l " ,   " s c h e d _ g e t a f f i n i t y " ,   " m u n m a p " ,   " b r k " ,   " r t _ s i g a c t i o n " ,   " r t _ s i g p r o c m a s k " ,   " s i g a l t s t a c k " ,   " g e t t i d " ,   " c l o n e " ,   " b i n d " ,   " s o c k e t " ,   " o p e n a t " ,   " r e a d l i n k a t " ,   " e x i t _ g r o u p " ,   " e p o l l _ c r e a t e 1 " ,   " l i s t e n " ,   " r t _ s i g r e t u r n " ,   " s c h e d _ y i e l d " ,   " c l o c k _ g e t t i m e " ,   " c o n n e c t


Question: What is Create a local Kubernetes cluster with kind?

Answer: F o r   s i m p l i c i t y ,   k i n d   c a n   b e   u s e d   t o   c r e a t e   a   s i n g l e   n o d e   c l u s t e r   w i t h   t h e   s e c c o m p   p r o f i l e s   l o a d e d .   K i n d   r u n s   K u b e r n e t e s   i n   D o c k e r ,   s o   e a c h   n o d e   o f   t h e   c l u s t e r   i s   a   c o n t a i n e r .   T h i s   a l l o w s   f o r   f i l e s   t o   b e   m o u n t e d   i n   t h e   f i l e s y s t e m   o f   e a c h   c o n t a i n e r   s i m i l a r   t o   l o a d i n g   f i l e s   o n t o   a   n o d e .   a p i V e r s i o n :   k i n d . x - k 8 s . i o / v 1 a l p h a 4   k i n d :   C l u s t e r   n o d e s :   -   r o l e :   c o n t r o l - p l a n e   e x t r a M o u n t s :   -   h o s t P a t h :   " . / p r o f i l e s "   c o n t a i n e r P a t h :   " / v a r / l i b / k u b e l e t / s e c c o m p / p r o f i l e s "   D o w n l o a d   t h a t   e x a m p l e   k i n d   c o n f i g u r a t i o n ,   a n d   s a v e   i t   t o   a   f i l e   n a m e d   k i n d . y a m l :   c u r l   - L   - O   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s e c u r i t y / s e c c o m p / k i n d . y a m l   Y o u   c a n   s e t   a   s p e c i f i c   K u b e r n e t e s   v e r s i o n   b y   s e t t i n g   t h e   n o d e ' s   c o n t a i n e r   i m a g e .   S e e   N o d e s   w i t h i n   t h e   k i n d   d o c u m e n t a t i o n   a b o u t   c o n f i g u r a t i o n   f o r   m o r e   d e t a i l s   o n   t h i s .   T h i s   t u t o r i a l   a s s u m e s   y o u   a r e   u s i n g   K u b e r n e t e s   v 1 . 3 4 .   A s   a   b e t a   f e a t u r e ,   y o u   c a n   c o n f i g u r e   K u b e r n e t e s   t o   u s e   t h e   p r o f i l e   t h a t   t h e   c o n t a i n e r   r u n t i m e   p r e f e r s   b y   d e f a u l t ,   r a t h e r   t h a n   f a l l i n g   b a c k   t o   U n c o n f i n e d .   I f   y o u   w a n t   t o   t r y   t h a t ,


Question: What is Create a Pod that uses the container runtime default seccomp profile?

Answer: M o s t   c o n t a i n e r   r u n t i m e s   p r o v i d e   a   s a n e   s e t   o f   d e f a u l t   s y s c a l l s   t h a t   a r e   a l l o w e d   o r   n o t .   Y o u   c a n   a d o p t   t h e s e   d e f a u l t s   f o r   y o u r   w o r k l o a d   b y   s e t t i n g   t h e   s e c c o m p   t y p e   i n   t h e   s e c u r i t y   c o n t e x t   o f   a   p o d   o r   c o n t a i n e r   t o   R u n t i m e D e f a u l t .


Question: What is Note:?

Answer: H e r e ' s   a   m a n i f e s t   f o r   a   P o d   t h a t   r e q u e s t s   t h e   R u n t i m e D e f a u l t   s e c c o m p   p r o f i l e   f o r   a l l   i t s   c o n t a i n e r s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   d e f a u l t - p o d   l a b e l s :   a p p :   d e f a u l t - p o d   s p e c :   s e c u r i t y C o n t e x t :   s e c c o m p P r o f i l e :   t y p e :   R u n t i m e D e f a u l t   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   h a s h i c o r p / h t t p - e c h o : 1 . 0   a r g s :   -   " - t e x t = j u s t   m a d e   s o m e   m o r e   s y s c a l l s ! "   s e c u r i t y C o n t e x t :   a l l o w P r i v i l e g e E s c a l a t i o n :   f a l s e   C r e a t e   t h a t   P o d :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s e c u r i t y / s e c c o m p / g a / d e f a u l t - p o d . y a m l   k u b e c t l   g e t   p o d   d e f a u l t - p o d   T h e   P o d   s h o u l d   b e   s h o w i n g   a s   h a v i n g   s t a r t e d   s u c c e s s f u l l y :   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   d e f a u l t - p o d   1 / 1   R u n n i n g   0   2 0 s   D e l e t e   t h e   P o d   b e f o r e   m o v i n g   t o   t h e   n e x t   s e c t i o n :   k u b e c t l   d e l e t e   p o d   d e f a u l t - p o d   - - w a i t   - - n o w


Question: What is Create a Pod with a seccomp profile for syscall auditing?

Answer: T o   s t a r t   o f f ,   a p p l y   t h e   a u d i t . j s o n   p r o f i l e ,   w h i c h   w i l l   l o g   a l l   s y s c a l l s   o f   t h e   p r o c e s s ,   t o   a   n e w   P o d .   H e r e ' s   a   m a n i f e s t   f o r   t h a t   P o d :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   a u d i t - p o d   l a b e l s :   a p p :   a u d i t - p o d   s p e c :   s e c u r i t y C o n t e x t :   s e c c o m p P r o f i l e :   t y p e :   L o c a l h o s t   l o c a l h o s t P r o f i l e :   p r o f i l e s / a u d i t . j s o n   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   h a s h i c o r p / h t t p - e c h o : 1 . 0   a r g s :   -   " - t e x t = j u s t   m a d e   s o m e   s y s c a l l s ! "   s e c u r i t y C o n t e x t :   a l l o w P r i v i l e g e E s c a l a t i o n :   f a l s e


Question: What is Note:?

Answer: C r e a t e   t h e   P o d   i n   t h e   c l u s t e r :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s e c u r i t y / s e c c o m p / g a / a u d i t - p o d . y a m l   T h i s   p r o f i l e   d o e s   n o t   r e s t r i c t   a n y   s y s c a l l s ,   s o   t h e   P o d   s h o u l d   s t a r t   s u c c e s s f u l l y .   k u b e c t l   g e t   p o d   a u d i t - p o d   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   a u d i t - p o d   1 / 1   R u n n i n g   0   3 0 s   I n   o r d e r   t o   b e   a b l e   t o   i n t e r a c t   w i t h   t h i s   e n d p o i n t   e x p o s e d   b y   t h i s   c o n t a i n e r ,   c r e a t e   a   N o d e P o r t   S e r v i c e   t h a t   a l l o w s   a c c e s s   t o   t h e   e n d p o i n t   f r o m   i n s i d e   t h e   k i n d   c o n t r o l   p l a n e   c o n t a i n e r .   k u b e c t l   e x p o s e   p o d   a u d i t - p o d   - - t y p e   N o d e P o r t   - - p o r t   5 6 7 8   C h e c k   w h a t   p o r t   t h e   S e r v i c e   h a s   b e e n   a s s i g n e d   o n   t h e   n o d e .   k u b e c t l   g e t   s e r v i c e   a u d i t - p o d   T h e   o u t p u t   i s   s i m i l a r   t o :   N A M E   T Y P E   C L U S T E R - I P   E X T E R N A L - I P   P O R T ( S )   A G E   a u d i t - p o d   N o d e P o r t   1 0 . 1 1 1 . 3 6 . 1 4 2   < n o n e >   5 6 7 8 : 3 2 3 7 3 / T C P   7 2 s   N o w   y o u   c a n   u s e   c u r l   t o   a c c e s s   t h a t   e n d p o i n t   f r o m   i n s i d e   t h e   k i n d   c o n t r o l   p l a n e   c o n t a i n e r ,   a t   t h e   p o r t   e x p o s e d   b y   t h i s   S e r v i c e .   U s e   d o c k e r   e x e c   t o   r u n   t h e   c u r l   c o m m a n d   w i t h i n   t h e   c o n t a i n e r   b e l o n g i n g   t o   t h a t   c o n t r o l   p l a n e   c o n t a i n e r :   #   C h a n g e   6 a 9 6 2 0 7 f e d 4 b   t o   t h


Question: What is Create a Pod with a seccomp profile that causes violation?

Answer: F o r   d e m o n s t r a t i o n ,   a p p l y   a   p r o f i l e   t o   t h e   P o d   t h a t   d o e s   n o t   a l l o w   f o r   a n y   s y s c a l l s .   T h e   m a n i f e s t   f o r   t h i s   d e m o n s t r a t i o n   i s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   v i o l a t i o n - p o d   l a b e l s :   a p p :   v i o l a t i o n - p o d   s p e c :   s e c u r i t y C o n t e x t :   s e c c o m p P r o f i l e :   t y p e :   L o c a l h o s t   l o c a l h o s t P r o f i l e :   p r o f i l e s / v i o l a t i o n . j s o n   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   h a s h i c o r p / h t t p - e c h o : 1 . 0   a r g s :   -   " - t e x t = j u s t   m a d e   s o m e   s y s c a l l s ! "   s e c u r i t y C o n t e x t :   a l l o w P r i v i l e g e E s c a l a t i o n :   f a l s e   A t t e m p t   t o   c r e a t e   t h e   P o d   i n   t h e   c l u s t e r :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s e c u r i t y / s e c c o m p / g a / v i o l a t i o n - p o d . y a m l   T h e   P o d   c r e a t e s ,   b u t   t h e r e   i s   a n   i s s u e .   I f   y o u   c h e c k   t h e   s t a t u s   o f   t h e   P o d ,   y o u   s h o u l d   s e e   t h a t   i t   f a i l e d   t o   s t a r t .   k u b e c t l   g e t   p o d   v i o l a t i o n - p o d   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   v i o l a t i o n - p o d   0 / 1   C r a s h L o o p B a c k O f f   1   6 s   A s   s e e n   i n   t h e   p r e v i o u s   e x a m p l e ,   t h e   h t t p - e c h o   p r o c e s s   r e q u i r e s   q u i t e   a   f e w   s y s c a l l s .   H e r e   s e c c o m p   h a s   b e e n   i n s t r u c t e d   t o   e r r o r   o n   a n y   s y s c a l l   b y   s e t t i n g   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ E R R N O " .   T h i s   i s


Question: What is Create a Pod with a seccomp profile that only allows necessary syscalls?

Answer: I f   y o u   t a k e   a   l o o k   a t   t h e   f i n e - g r a i n e d . j s o n   p r o f i l e ,   y o u   w i l l   n o t i c e   s o m e   o f   t h e   s y s c a l l s   s e e n   i n   s y s l o g   o f   t h e   f i r s t   e x a m p l e   w h e r e   t h e   p r o f i l e   s e t   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ L O G " .   N o w   t h e   p r o f i l e   i s   s e t t i n g   " d e f a u l t A c t i o n " :   " S C M P _ A C T _ E R R N O " ,   b u t   e x p l i c i t l y   a l l o w i n g   a   s e t   o f   s y s c a l l s   i n   t h e   " a c t i o n " :   " S C M P _ A C T _ A L L O W "   b l o c k .   I d e a l l y ,   t h e   c o n t a i n e r   w i l l   r u n   s u c c e s s f u l l y   a n d   y o u   w i l l   s e e   n o   m e s s a g e s   s e n t   t o   s y s l o g .   T h e   m a n i f e s t   f o r   t h i s   e x a m p l e   i s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   f i n e - p o d   l a b e l s :   a p p :   f i n e - p o d   s p e c :   s e c u r i t y C o n t e x t :   s e c c o m p P r o f i l e :   t y p e :   L o c a l h o s t   l o c a l h o s t P r o f i l e :   p r o f i l e s / f i n e - g r a i n e d . j s o n   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   h a s h i c o r p / h t t p - e c h o : 1 . 0   a r g s :   -   " - t e x t = j u s t   m a d e   s o m e   s y s c a l l s ! "   s e c u r i t y C o n t e x t :   a l l o w P r i v i l e g e E s c a l a t i o n :   f a l s e   C r e a t e   t h e   P o d   i n   y o u r   c l u s t e r :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s e c u r i t y / s e c c o m p / g a / f i n e - p o d . y a m l   k u b e c t l   g e t   p o d   f i n e - p o d   T h e   P o d   s h o u l d   b e   s h o w i n g   a s   h a v i n g   s t a r t e d   s u c c e s s f u l l y :   N A M E   R E A D Y   S T A T U S   R E S T A R T S


Question: What is Enable the use of RuntimeDefault as the default seccomp profile for all workloads?

Answer: T o   u s e   s e c c o m p   p r o f i l e   d e f a u l t i n g ,   y o u   m u s t   r u n   t h e   k u b e l e t   w i t h   t h e   - - s e c c o m p - d e f a u l t   c o m m a n d   l i n e   f l a g   e n a b l e d   f o r   e a c h   n o d e   w h e r e   y o u   w a n t   t o   u s e   i t .   I f   e n a b l e d ,   t h e   k u b e l e t   w i l l   u s e   t h e   R u n t i m e D e f a u l t   s e c c o m p   p r o f i l e   b y   d e f a u l t ,   w h i c h   i s   d e f i n e d   b y   t h e   c o n t a i n e r   r u n t i m e ,   i n s t e a d   o f   u s i n g   t h e   U n c o n f i n e d   ( s e c c o m p   d i s a b l e d )   m o d e .   T h e   d e f a u l t   p r o f i l e s   a i m   t o   p r o v i d e   a   s t r o n g   s e t   o f   s e c u r i t y   d e f a u l t s   w h i l e   p r e s e r v i n g   t h e   f u n c t i o n a l i t y   o f   t h e   w o r k l o a d .   I t   i s   p o s s i b l e   t h a t   t h e   d e f a u l t   p r o f i l e s   d i f f e r   b e t w e e n   c o n t a i n e r   r u n t i m e s   a n d   t h e i r   r e l e a s e   v e r s i o n s ,   f o r   e x a m p l e   w h e n   c o m p a r i n g   t h o s e   f r o m   C R I - O   a n d   c o n t a i n e r d .