Question: What is OpenAPI V2?

Answer: T h e   K u b e r n e t e s   A P I   s e r v e r   s e r v e s   a n   a g g r e g a t e d   O p e n A P I   v 2   s p e c   v i a   t h e   / o p e n a p i / v 2   e n d p o i n t .   Y o u   c a n   r e q u e s t   t h e   r e s p o n s e   f o r m a t   u s i n g   r e q u e s t   h e a d e r s   a s   f o l l o w s :


Question: What is OpenAPI V3?

Answer: K u b e r n e t e s   s u p p o r t s   p u b l i s h i n g   a   d e s c r i p t i o n   o f   i t s   A P I s   a s   O p e n A P I   v 3 .   A   d i s c o v e r y   e n d p o i n t   / o p e n a p i / v 3   i s   p r o v i d e d   t o   s e e   a   l i s t   o f   a l l   g r o u p / v e r s i o n s   a v a i l a b l e .   T h i s   e n d p o i n t   o n l y   r e t u r n s   J S O N .   T h e s e   g r o u p / v e r s i o n s   a r e   p r o v i d e d   i n   t h e   f o l l o w i n g   f o r m a t :   {   " p a t h s " :   {   . . . ,   " a p i / v 1 " :   {   " s e r v e r R e l a t i v e U R L " :   " / o p e n a p i / v 3 / a p i / v 1 ? h a s h = C C 0 E 9 B F D 9 9 2 D 8 C 5 9 A E C 9 8 A 1 E 2 3 3 6 F 8 9 9 E 8 3 1 8 D 3 C F 4 C 6 8 9 4 4 C 3 D E C 6 4 0 A F 5 A B 5 2 D 8 6 4 A C 5 0 D A A 8 D 1 4 5 B 3 4 9 4 F 7 5 F A 3 C F F 9 3 9 F C B D D A 4 3 1 D A D 3 C A 7 9 7 3 8 B 2 9 7 7 9 5 8 1 8 C F "   } ,   " a p i s / a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1 " :   {   " s e r v e r R e l a t i v e U R L " :   " / o p e n a p i / v 3 / a p i s / a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1 ? h a s h = E 1 9 C C 9 3 A 1 1 6 9 8 2 C E 5 4 2 2 F C 4 2 B 5 9 0 A 8 A F A D 9 2 C D E 9 A E 4 D 5 9 B 5 C A A D 5 6 8 F 0 8 3 A D 0 7 9 4 6 E 6 C B 5 8 1 7 5 3 1 6 8 0 B C E 6 E 2 1 5 C 1 6 9 7 3 C D 3 9 0 0 3 B 0 4 2 5 F 3 4 7 7 C F D 8 5 4 E 8 9 A 9 D B 6 5 9 7 "   } ,   . . . .   }   }   T h e   r e l a t i v e   U R L s   a r e   p o i n t i n g   t o   i m m u t a b l e   O p e n A P I   d e s c r i p t i o n s ,   i n   o r d e r   t o   i m p r o v e   c l i e n t - s i d e   c a c h i n g .   T h e   p r o p e r   H T T P   c a c h i n g   h e a d e r s   a r e   a l s o   s e t   b y   t h e   A P I   s e r v e r   f o r   t h a t   p u r p o s e   ( E x p i r e s   t o   1   y e a r   i n   t h e   f u t u r e ,   a n d   C a c h e - C o n t r o l   t o   i m m u t a b l e ) .   W h e n   a n   o b s o l e t e   U R L


Question: What is Protobuf serialization?

Answer: K u b e r n e t e s   i m p l e m e n t s   a n   a l t e r n a t i v e   P r o t o b u f   b a s e d   s e r i a l i z a t i o n   f o r m a t   t h a t   i s   p r i m a r i l y   i n t e n d e d   f o r   i n t r a - c l u s t e r   c o m m u n i c a t i o n .   F o r   m o r e   i n f o r m a t i o n   a b o u t   t h i s   f o r m a t ,   s e e   t h e   K u b e r n e t e s   P r o t o b u f   s e r i a l i z a t i o n   d e s i g n   p r o p o s a l   a n d   t h e   I n t e r f a c e   D e f i n i t i o n   L a n g u a g e   ( I D L )   f i l e s   f o r   e a c h   s c h e m a   l o c a t e d   i n   t h e   G o   p a c k a g e s   t h a t   d e f i n e   t h e   A P I   o b j e c t s .


Question: What is Persistence?

Answer: K u b e r n e t e s   s t o r e s   t h e   s e r i a l i z e d   s t a t e   o f   o b j e c t s   b y   w r i t i n g   t h e m   i n t o   e t c d .


Question: What is API groups and versioning?

Answer: T o   m a k e   i t   e a s i e r   t o   e l i m i n a t e   f i e l d s   o r   r e s t r u c t u r e   r e s o u r c e   r e p r e s e n t a t i o n s ,   K u b e r n e t e s   s u p p o r t s   m u l t i p l e   A P I   v e r s i o n s ,   e a c h   a t   a   d i f f e r e n t   A P I   p a t h ,   s u c h   a s   / a p i / v 1   o r   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 a l p h a 1 .   V e r s i o n i n g   i s   d o n e   a t   t h e   A P I   l e v e l   r a t h e r   t h a n   a t   t h e   r e s o u r c e   o r   f i e l d   l e v e l   t o   e n s u r e   t h a t   t h e   A P I   p r e s e n t s   a   c l e a r ,   c o n s i s t e n t   v i e w   o f   s y s t e m   r e s o u r c e s   a n d   b e h a v i o r ,   a n d   t o   e n a b l e   c o n t r o l l i n g   a c c e s s   t o   e n d - o f - l i f e   a n d / o r   e x p e r i m e n t a l   A P I s .   T o   m a k e   i t   e a s i e r   t o   e v o l v e   a n d   t o   e x t e n d   i t s   A P I ,   K u b e r n e t e s   i m p l e m e n t s   A P I   g r o u p s   t h a t   c a n   b e   e n a b l e d   o r   d i s a b l e d .   A P I   r e s o u r c e s   a r e   d i s t i n g u i s h e d   b y   t h e i r   A P I   g r o u p ,   r e s o u r c e   t y p e ,   n a m e s p a c e   ( f o r   n a m e s p a c e d   r e s o u r c e s ) ,   a n d   n a m e .   T h e   A P I   s e r v e r   h a n d l e s   t h e   c o n v e r s i o n   b e t w e e n   A P I   v e r s i o n s   t r a n s p a r e n t l y :   a l l   t h e   d i f f e r e n t   v e r s i o n s   a r e   a c t u a l l y   r e p r e s e n t a t i o n s   o f   t h e   s a m e   p e r s i s t e d   d a t a .   T h e   A P I   s e r v e r   m a y   s e r v e   t h e   s a m e   u n d e r l y i n g   d a t a   t h r o u g h   m u l t i p l e   A P I   v e r s i o n s .   F o r   e x a m p l e ,   s u p p o s e   t h e r e   a r e   t w o   A P I   v e r s i o n s ,   v 1   a n d   v 1 b e t a 1 ,   f o r   t h e


Question: What is API changes?

Answer: A n y   s y s t e m   t h a t   i s   s u c c e s s f u l   n e e d s   t o   g r o w   a n d   c h a n g e   a s   n e w   u s e   c a s e s   e m e r g e   o r   e x i s t i n g   o n e s   c h a n g e .   T h e r e f o r e ,   K u b e r n e t e s   h a s   d e s i g n e d   t h e   K u b e r n e t e s   A P I   t o   c o n t i n u o u s l y   c h a n g e   a n d   g r o w .   T h e   K u b e r n e t e s   p r o j e c t   a i m s   t o   n o t   b r e a k   c o m p a t i b i l i t y   w i t h   e x i s t i n g   c l i e n t s ,   a n d   t o   m a i n t a i n   t h a t   c o m p a t i b i l i t y   f o r   a   l e n g t h   o f   t i m e   s o   t h a t   o t h e r   p r o j e c t s   h a v e   a n   o p p o r t u n i t y   t o   a d a p t .   I n   g e n e r a l ,   n e w   A P I   r e s o u r c e s   a n d   n e w   r e s o u r c e   f i e l d s   c a n   b e   a d d e d   o f t e n   a n d   f r e q u e n t l y .   E l i m i n a t i o n   o f   r e s o u r c e s   o r   f i e l d s   r e q u i r e s   f o l l o w i n g   t h e   A P I   d e p r e c a t i o n   p o l i c y .   K u b e r n e t e s   m a k e s   a   s t r o n g   c o m m i t m e n t   t o   m a i n t a i n   c o m p a t i b i l i t y   f o r   o f f i c i a l   K u b e r n e t e s   A P I s   o n c e   t h e y   r e a c h   g e n e r a l   a v a i l a b i l i t y   ( G A ) ,   t y p i c a l l y   a t   A P I   v e r s i o n   v 1 .   A d d i t i o n a l l y ,   K u b e r n e t e s   m a i n t a i n s   c o m p a t i b i l i t y   w i t h   d a t a   p e r s i s t e d   v i a   b e t a   A P I   v e r s i o n s   o f   o f f i c i a l   K u b e r n e t e s   A P I s ,   a n d   e n s u r e s   t h a t   d a t a   c a n   b e   c o n v e r t e d   a n d   a c c e s s e d   v i a   G A   A P I   v e r s i o n s   w h e n   t h e   f e a t u r e   g o e s   s t a b l e .   I f   y o u   a d o p t   a   b e t a   A P I   v e r s i o n ,   y o u   w i l l   n e e d   t o   t r a n s i t i o n   t o   a


Question: What is Note:?

Answer: R e f e r   t o   A P I   v e r s i o n s   r e f e r e n c e   f o r   m o r e   d e t a i l s   o n   t h e   A P I   v e r s i o n   l e v e l   d e f i n i t i o n s .


Question: What is API Extension?

Answer: T h e   K u b e r n e t e s   A P I   c a n   b e   e x t e n d e d   i n   o n e   o f   t w o   w a y s :   C u s t o m   r e s o u r c e s   l e t   y o u   d e c l a r a t i v e l y   d e f i n e   h o w   t h e   A P I   s e r v e r   s h o u l d   p r o v i d e   y o u r   c h o s e n   r e s o u r c e   A P I . Y o u   c a n   a l s o   e x t e n d   t h e   K u b e r n e t e s   A P I   b y   i m p l e m e n t i n g   a n   a g g r e g a t i o n   l a y e r .


Question: What is What's next?

Answer: L e a r n   h o w   t o   e x t e n d   t h e   K u b e r n e t e s   A P I   b y   a d d i n g   y o u r   o w n   C u s t o m R e s o u r c e D e f i n i t i o n . C o n t r o l l i n g   A c c e s s   T o   T h e   K u b e r n e t e s   A P I   d e s c r i b e s   h o w   t h e   c l u s t e r   m a n a g e s   a u t h e n t i c a t i o n   a n d   a u t h o r i z a t i o n   f o r   A P I   a c c e s s . L e a r n   a b o u t   A P I   e n d p o i n t s ,   r e s o u r c e   t y p e s   a n d   s a m p l e s   b y   r e a d i n g   A P I   R e f e r e n c e . L e a r n   a b o u t   w h a t   c o n s t i t u t e s   a   c o m p a t i b l e   c h a n g e ,   a n d   h o w   t o   c h a n g e   t h e   A P I ,   f r o m   A P I   c h a n g e s .   ©   2 0 2 5   T h e   K u b e r n e t e s   A u t h o r s   |   D o c u m e n t a t i o n   D i s t r i b u t e d   u n d e r   C C   B Y   4 . 0   ©   2 0 2 5   T h e   L i n u x   F o u n d a t i o n   ® .   A l l   r i g h t s   r e s e r v e d .   T h e   L i n u x   F o u n d a t i o n   h a s   r e g i s t e r e d   t r a d e m a r k s   a n d   u s e s   t r a d e m a r k s .   F o r   a   l i s t   o f   t r a d e m a r k s   o f   T h e   L i n u x   F o u n d a t i o n ,   p l e a s e   s e e   o u r   T r a d e m a r k   U s a g e   p a g e   I C P   l i c e n s e :   京 I C P 备 1 7 0 7 4 2 6 6 号 - 3


Question: What is Kubernetes API health endpoints?

Answer: Kubernetes API health endpointsThe Kubernetes API server provides API endpoints to indicate the current status of the API server. This page describes these API endpoints and explains how you can use them.API endpoints for healthThe Kubernetes API server provides 3 API endpoints (healthz, livez and readyz) to indicate the current status of the API server. The healthz endpoint is deprecated (since Kubernetes v1.16), and you should use the more specific livez and readyz endpoints instead. The livez endpoint can be used with the --livez-grace-period flag to specify the startup duration. For a graceful shutdown you can specify the --shutdown-delay-duration flag with the /readyz endpoint. Machines that check the healthz/livez/readyz of the API server should rely on the HTTP status code. A status code 200 indicates the API server is healthy/live/ready, depending on the called endpoint. The more verbose options shown below are intended to be used by human operators to debug their cluster or understand the state of the API server.The following examples will show how you can interact with the health API endpoints.For all endpoints, you can use the verbose parameter to print out the checks and their status. This can be useful for a human operator to debug the current status of the API server, it is not intended to be consumed by a machine:curl -k https://localhost:6443/livez?verbose or from a remote host with authentication:kubectl get --raw='/readyz?verbose' The output will look like this:[+]ping ok [+]log ok [+]etcd ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priority-classes ok [+]poststarthook/start-cluster-authentication-info-controller ok [+]poststarthook/start-kube-aggregator-informers ok [+]poststarthook/apiservice-registration-controller ok [+]poststarthook/apiservice-status-available-controller ok [+]poststarthook/kube-apiserver-autoregistration ok [+]autoregister-completion ok [+]poststarthook/apiservice-openapi-controller ok healthz check passed The Kubernetes API server also supports to exclude specific checks. The query parameters can also be combined like in this example:curl -k 'https://localhost:6443/readyz?verbose&exclude=etcd' The output show that the etcd check is excluded:[+]ping ok [+]log ok [+]etcd excluded: ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priori


Question: How does Kubernetes API health endpoints work?

Answer: Kubernetes API health endpointsThe Kubernetes API server provides API endpoints to indicate the current status of the API server. This page describes these API endpoints and explains how you can use them.API endpoints for healthThe Kubernetes API server provides 3 API endpoints (healthz, livez and readyz) to indicate the current status of the API server. The healthz endpoint is deprecated (since Kubernetes v1.16), and you should use the more specific livez and readyz endpoints instead. The livez endpoint can be used with the --livez-grace-period flag to specify the startup duration. For a graceful shutdown you can specify the --shutdown-delay-duration flag with the /readyz endpoint. Machines that check the healthz/livez/readyz of the API server should rely on the HTTP status code. A status code 200 indicates the API server is healthy/live/ready, depending on the called endpoint. The more verbose options shown below are intended to be used by human operators to debug their cluster or understand the state of the API server.The following examples will show how you can interact with the health API endpoints.For all endpoints, you can use the verbose parameter to print out the checks and their status. This can be useful for a human operator to debug the current status of the API server, it is not intended to be consumed by a machine:curl -k https://localhost:6443/livez?verbose or from a remote host with authentication:kubectl get --raw='/readyz?verbose' The output will look like this:[+]ping ok [+]log ok [+]etcd ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priority-classes ok [+]poststarthook/start-cluster-authentication-info-controller ok [+]poststarthook/start-kube-aggregator-informers ok [+]poststarthook/apiservice-registration-controller ok [+]poststarthook/apiservice-status-available-controller ok [+]poststarthook/kube-apiserver-autoregistration ok [+]autoregister-completion ok [+]poststarthook/apiservice-openapi-controller ok healthz check passed The Kubernetes API server also supports to exclude specific checks. The query parameters can also be combined like in this example:curl -k 'https://localhost:6443/readyz?verbose&exclude=etcd' The output show that the etcd check is excluded:[+]ping ok [+]log ok [+]etcd excluded: ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priori


Question: When would you use Kubernetes API health endpoints?

Answer: Kubernetes API health endpointsThe Kubernetes API server provides API endpoints to indicate the current status of the API server. This page describes these API endpoints and explains how you can use them.API endpoints for healthThe Kubernetes API server provides 3 API endpoints (healthz, livez and readyz) to indicate the current status of the API server. The healthz endpoint is deprecated (since Kubernetes v1.16), and you should use the more specific livez and readyz endpoints instead. The livez endpoint can be used with the --livez-grace-period flag to specify the startup duration. For a graceful shutdown you can specify the --shutdown-delay-duration flag with the /readyz endpoint. Machines that check the healthz/livez/readyz of the API server should rely on the HTTP status code. A status code 200 indicates the API server is healthy/live/ready, depending on the called endpoint. The more verbose options shown below are intended to be used by human operators to debug their cluster or understand the state of the API server.The following examples will show how you can interact with the health API endpoints.For all endpoints, you can use the verbose parameter to print out the checks and their status. This can be useful for a human operator to debug the current status of the API server, it is not intended to be consumed by a machine:curl -k https://localhost:6443/livez?verbose or from a remote host with authentication:kubectl get --raw='/readyz?verbose' The output will look like this:[+]ping ok [+]log ok [+]etcd ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priority-classes ok [+]poststarthook/start-cluster-authentication-info-controller ok [+]poststarthook/start-kube-aggregator-informers ok [+]poststarthook/apiservice-registration-controller ok [+]poststarthook/apiservice-status-available-controller ok [+]poststarthook/kube-apiserver-autoregistration ok [+]autoregister-completion ok [+]poststarthook/apiservice-openapi-controller ok healthz check passed The Kubernetes API server also supports to exclude specific checks. The query parameters can also be combined like in this example:curl -k 'https://localhost:6443/readyz?verbose&exclude=etcd' The output show that the etcd check is excluded:[+]ping ok [+]log ok [+]etcd excluded: ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priori


Question: What are the benefits of Kubernetes API health endpoints?

Answer: Kubernetes API health endpointsThe Kubernetes API server provides API endpoints to indicate the current status of the API server. This page describes these API endpoints and explains how you can use them.API endpoints for healthThe Kubernetes API server provides 3 API endpoints (healthz, livez and readyz) to indicate the current status of the API server. The healthz endpoint is deprecated (since Kubernetes v1.16), and you should use the more specific livez and readyz endpoints instead. The livez endpoint can be used with the --livez-grace-period flag to specify the startup duration. For a graceful shutdown you can specify the --shutdown-delay-duration flag with the /readyz endpoint. Machines that check the healthz/livez/readyz of the API server should rely on the HTTP status code. A status code 200 indicates the API server is healthy/live/ready, depending on the called endpoint. The more verbose options shown below are intended to be used by human operators to debug their cluster or understand the state of the API server.The following examples will show how you can interact with the health API endpoints.For all endpoints, you can use the verbose parameter to print out the checks and their status. This can be useful for a human operator to debug the current status of the API server, it is not intended to be consumed by a machine:curl -k https://localhost:6443/livez?verbose or from a remote host with authentication:kubectl get --raw='/readyz?verbose' The output will look like this:[+]ping ok [+]log ok [+]etcd ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priority-classes ok [+]poststarthook/start-cluster-authentication-info-controller ok [+]poststarthook/start-kube-aggregator-informers ok [+]poststarthook/apiservice-registration-controller ok [+]poststarthook/apiservice-status-available-controller ok [+]poststarthook/kube-apiserver-autoregistration ok [+]autoregister-completion ok [+]poststarthook/apiservice-openapi-controller ok healthz check passed The Kubernetes API server also supports to exclude specific checks. The query parameters can also be combined like in this example:curl -k 'https://localhost:6443/readyz?verbose&exclude=etcd' The output show that the etcd check is excluded:[+]ping ok [+]log ok [+]etcd excluded: ok [+]poststarthook/start-kube-apiserver-admission-initializer ok [+]poststarthook/generic-apiserver-start-informers ok [+]poststarthook/start-apiextensions-informers ok [+]poststarthook/start-apiextensions-controllers ok [+]poststarthook/crd-informer-synced ok [+]poststarthook/bootstrap-controller ok [+]poststarthook/rbac/bootstrap-roles ok [+]poststarthook/scheduling/bootstrap-system-priori


Question: What is Kubernetes API health endpoints?

Answer: T h e   K u b e r n e t e s   A P I   s e r v e r   p r o v i d e s   A P I   e n d p o i n t s   t o   i n d i c a t e   t h e   c u r r e n t   s t a t u s   o f   t h e   A P I   s e r v e r .   T h i s   p a g e   d e s c r i b e s   t h e s e   A P I   e n d p o i n t s   a n d   e x p l a i n s   h o w   y o u   c a n   u s e   t h e m .


Question: What is API endpoints for health?

Answer: T h e   K u b e r n e t e s   A P I   s e r v e r   p r o v i d e s   3   A P I   e n d p o i n t s   ( h e a l t h z ,   l i v e z   a n d   r e a d y z )   t o   i n d i c a t e   t h e   c u r r e n t   s t a t u s   o f   t h e   A P I   s e r v e r .   T h e   h e a l t h z   e n d p o i n t   i s   d e p r e c a t e d   ( s i n c e   K u b e r n e t e s   v 1 . 1 6 ) ,   a n d   y o u   s h o u l d   u s e   t h e   m o r e   s p e c i f i c   l i v e z   a n d   r e a d y z   e n d p o i n t s   i n s t e a d .   T h e   l i v e z   e n d p o i n t   c a n   b e   u s e d   w i t h   t h e   - - l i v e z - g r a c e - p e r i o d   f l a g   t o   s p e c i f y   t h e   s t a r t u p   d u r a t i o n .   F o r   a   g r a c e f u l   s h u t d o w n   y o u   c a n   s p e c i f y   t h e   - - s h u t d o w n - d e l a y - d u r a t i o n   f l a g   w i t h   t h e   / r e a d y z   e n d p o i n t .   M a c h i n e s   t h a t   c h e c k   t h e   h e a l t h z / l i v e z / r e a d y z   o f   t h e   A P I   s e r v e r   s h o u l d   r e l y   o n   t h e   H T T P   s t a t u s   c o d e .   A   s t a t u s   c o d e   2 0 0   i n d i c a t e s   t h e   A P I   s e r v e r   i s   h e a l t h y / l i v e / r e a d y ,   d e p e n d i n g   o n   t h e   c a l l e d   e n d p o i n t .   T h e   m o r e   v e r b o s e   o p t i o n s   s h o w n   b e l o w   a r e   i n t e n d e d   t o   b e   u s e d   b y   h u m a n   o p e r a t o r s   t o   d e b u g   t h e i r   c l u s t e r   o r   u n d e r s t a n d   t h e   s t a t e   o f   t h e   A P I   s e r v e r .   T h e   f o l l o w i n g   e x a m p l e s   w i l l   s h o w   h o w   y o u   c a n   i n t e r a c t   w i t h   t h e   h e a l t h   A P I   e n d p o i n t s .   F o r   a l l   e n d p o i n t s ,   y o u   c a n   u s e   t h e   v e r b o s e   p a r a m e t e r   t o   p r i n t   o u t   t h e   c h e c k s   a n d   t h e i r   s t a t u s .   T h i s   c a n   b


Question: What is Individual health checks?

Answer: E a c h   i n d i v i d u a l   h e a l t h   c h e c k   e x p o s e s   a n   H T T P   e n d p o i n t   a n d   c a n   b e   c h e c k e d   i n d i v i d u a l l y .   T h e   s c h e m a   f o r   t h e   i n d i v i d u a l   h e a l t h   c h e c k s   i s   / l i v e z / < h e a l t h c h e c k - n a m e >   o r   / r e a d y z / < h e a l t h c h e c k - n a m e > ,   w h e r e   l i v e z   a n d   r e a d y z   c a n   b e   u s e d   t o   i n d i c a t e   i f   y o u   w a n t   t o   c h e c k   t h e   l i v e n e s s   o r   t h e   r e a d i n e s s   o f   t h e   A P I   s e r v e r ,   r e s p e c t i v e l y .   T h e   < h e a l t h c h e c k - n a m e >   p a t h   c a n   b e   d i s c o v e r e d   u s i n g   t h e   v e r b o s e   f l a g   f r o m   a b o v e   a n d   t a k e   t h e   p a t h   b e t w e e n   [ + ]   a n d   o k .   T h e s e   i n d i v i d u a l   h e a l t h   c h e c k s   s h o u l d   n o t   b e   c o n s u m e d   b y   m a c h i n e s   b u t   c a n   b e   h e l p f u l   f o r   a   h u m a n   o p e r a t o r   t o   d e b u g   a   s y s t e m :   c u r l   - k   h t t p s : / / l o c a l h o s t : 6 4 4 3 / l i v e z / e t c d


Question: What is Linux Node Swap Behaviors?

Answer: Linux Node Swap BehaviorsTo allow Kubernetes workloads to use swap, on a Linux node, you must disable the kubelet's default behavior of failing when swap is detected, and specify memory-swap behavior as LimitedSwap:The available choices for swap behavior are:NoSwap(default) Workloads running as Pods on this node do not and cannot use swap. However, processes outside of Kubernetes' scope, such as system daemons (including the kubelet itself!) can utilize swap. This behavior is beneficial for protecting the node from system-level memory spikes, but it does not safeguard the workloads themselves from such spikes.LimitedSwapKubernetes workloads can utilize swap memory. The amount of swap available to a Pod is determined automatically.To learn more, read swap memory management.


Question: How does Linux Node Swap Behaviors work?

Answer: Linux Node Swap BehaviorsTo allow Kubernetes workloads to use swap, on a Linux node, you must disable the kubelet's default behavior of failing when swap is detected, and specify memory-swap behavior as LimitedSwap:The available choices for swap behavior are:NoSwap(default) Workloads running as Pods on this node do not and cannot use swap. However, processes outside of Kubernetes' scope, such as system daemons (including the kubelet itself!) can utilize swap. This behavior is beneficial for protecting the node from system-level memory spikes, but it does not safeguard the workloads themselves from such spikes.LimitedSwapKubernetes workloads can utilize swap memory. The amount of swap available to a Pod is determined automatically.To learn more, read swap memory management.


Question: When would you use Linux Node Swap Behaviors?

Answer: Linux Node Swap BehaviorsTo allow Kubernetes workloads to use swap, on a Linux node, you must disable the kubelet's default behavior of failing when swap is detected, and specify memory-swap behavior as LimitedSwap:The available choices for swap behavior are:NoSwap(default) Workloads running as Pods on this node do not and cannot use swap. However, processes outside of Kubernetes' scope, such as system daemons (including the kubelet itself!) can utilize swap. This behavior is beneficial for protecting the node from system-level memory spikes, but it does not safeguard the workloads themselves from such spikes.LimitedSwapKubernetes workloads can utilize swap memory. The amount of swap available to a Pod is determined automatically.To learn more, read swap memory management.


Question: What are the benefits of Linux Node Swap Behaviors?

Answer: Linux Node Swap BehaviorsTo allow Kubernetes workloads to use swap, on a Linux node, you must disable the kubelet's default behavior of failing when swap is detected, and specify memory-swap behavior as LimitedSwap:The available choices for swap behavior are:NoSwap(default) Workloads running as Pods on this node do not and cannot use swap. However, processes outside of Kubernetes' scope, such as system daemons (including the kubelet itself!) can utilize swap. This behavior is beneficial for protecting the node from system-level memory spikes, but it does not safeguard the workloads themselves from such spikes.LimitedSwapKubernetes workloads can utilize swap memory. The amount of swap available to a Pod is determined automatically.To learn more, read swap memory management.


Question: What is Linux Node Swap Behaviors?

Answer: T o   a l l o w   K u b e r n e t e s   w o r k l o a d s   t o   u s e   s w a p ,   o n   a   L i n u x   n o d e ,   y o u   m u s t   d i s a b l e   t h e   k u b e l e t ' s   d e f a u l t   b e h a v i o r   o f   f a i l i n g   w h e n   s w a p   i s   d e t e c t e d ,   a n d   s p e c i f y   m e m o r y - s w a p   b e h a v i o r   a s   L i m i t e d S w a p :   T h e   a v a i l a b l e   c h o i c e s   f o r   s w a p   b e h a v i o r   a r e :   T o   l e a r n   m o r e ,   r e a d   s w a p   m e m o r y   m a n a g e m e n t .


Question: What is kubectl set subject?

Answer: kubectl set subjectSynopsisUpdate the user, group, or service account in a role binding or cluster role binding.kubectl set subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] Examples # Update a cluster role binding for serviceaccount1 kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1 # Update a role binding for user1, user2, and group1 kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1 # Print the result (in YAML format) of updating rolebinding subjects from a local, without hitting the server kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml Options--allSelect all resources, in the namespace of the specified resource types--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-set"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files the resource to update the subjects--group stringsGroups to bind to the role-h, --helphelp for subject-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--localIf true, set subject will NOT contact api-server but run locally.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--serviceaccount stringsService accounts to bind to the role--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--user stringsUsernames to bind to the roleParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cach


Question: How does kubectl set subject work?

Answer: kubectl set subjectSynopsisUpdate the user, group, or service account in a role binding or cluster role binding.kubectl set subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] Examples # Update a cluster role binding for serviceaccount1 kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1 # Update a role binding for user1, user2, and group1 kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1 # Print the result (in YAML format) of updating rolebinding subjects from a local, without hitting the server kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml Options--allSelect all resources, in the namespace of the specified resource types--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-set"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files the resource to update the subjects--group stringsGroups to bind to the role-h, --helphelp for subject-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--localIf true, set subject will NOT contact api-server but run locally.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--serviceaccount stringsService accounts to bind to the role--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--user stringsUsernames to bind to the roleParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cach


Question: When would you use kubectl set subject?

Answer: kubectl set subjectSynopsisUpdate the user, group, or service account in a role binding or cluster role binding.kubectl set subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] Examples # Update a cluster role binding for serviceaccount1 kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1 # Update a role binding for user1, user2, and group1 kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1 # Print the result (in YAML format) of updating rolebinding subjects from a local, without hitting the server kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml Options--allSelect all resources, in the namespace of the specified resource types--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-set"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files the resource to update the subjects--group stringsGroups to bind to the role-h, --helphelp for subject-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--localIf true, set subject will NOT contact api-server but run locally.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--serviceaccount stringsService accounts to bind to the role--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--user stringsUsernames to bind to the roleParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cach


Question: What are the benefits of kubectl set subject?

Answer: kubectl set subjectSynopsisUpdate the user, group, or service account in a role binding or cluster role binding.kubectl set subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] Examples # Update a cluster role binding for serviceaccount1 kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1 # Update a role binding for user1, user2, and group1 kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1 # Print the result (in YAML format) of updating rolebinding subjects from a local, without hitting the server kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml Options--allSelect all resources, in the namespace of the specified resource types--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-set"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files the resource to update the subjects--group stringsGroups to bind to the role-h, --helphelp for subject-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--localIf true, set subject will NOT contact api-server but run locally.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--serviceaccount stringsService accounts to bind to the role--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--user stringsUsernames to bind to the roleParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cach


Question: What is Synopsis?

Answer: U p d a t e   t h e   u s e r ,   g r o u p ,   o r   s e r v i c e   a c c o u n t   i n   a   r o l e   b i n d i n g   o r   c l u s t e r   r o l e   b i n d i n g .   k u b e c t l   s e t   s u b j e c t   ( - f   F I L E N A M E   |   T Y P E   N A M E )   [ - - u s e r = u s e r n a m e ]   [ - - g r o u p = g r o u p n a m e ]   [ - - s e r v i c e a c c o u n t = n a m e s p a c e : s e r v i c e a c c o u n t n a m e ]   [ - - d r y - r u n = s e r v e r | c l i e n t | n o n e ]


Question: What is Examples?

Answer: #   U p d a t e   a   c l u s t e r   r o l e   b i n d i n g   f o r   s e r v i c e a c c o u n t 1   k u b e c t l   s e t   s u b j e c t   c l u s t e r r o l e b i n d i n g   a d m i n   - - s e r v i c e a c c o u n t = n a m e s p a c e : s e r v i c e a c c o u n t 1   #   U p d a t e   a   r o l e   b i n d i n g   f o r   u s e r 1 ,   u s e r 2 ,   a n d   g r o u p 1   k u b e c t l   s e t   s u b j e c t   r o l e b i n d i n g   a d m i n   - - u s e r = u s e r 1   - - u s e r = u s e r 2   - - g r o u p = g r o u p 1   #   P r i n t   t h e   r e s u l t   ( i n   Y A M L   f o r m a t )   o f   u p d a t i n g   r o l e b i n d i n g   s u b j e c t s   f r o m   a   l o c a l ,   w i t h o u t   h i t t i n g   t h e   s e r v e r   k u b e c t l   c r e a t e   r o l e b i n d i n g   a d m i n   - - r o l e = a d m i n   - - u s e r = a d m i n   - o   y a m l   - - d r y - r u n = c l i e n t   |   k u b e c t l   s e t   s u b j e c t   - - l o c a l   - f   -   - - u s e r = f o o   - o   y a m l


Question: What is Options?

Answer: S e l e c t   a l l   r e s o u r c e s ,   i n   t h e   n a m e s p a c e   o f   t h e   s p e c i f i e d   r e s o u r c e   t y p e s   I f   t r u e ,   i g n o r e   a n y   e r r o r s   i n   t e m p l a t e s   w h e n   a   f i e l d   o r   m a p   k e y   i s   m i s s i n g   i n   t h e   t e m p l a t e .   O n l y   a p p l i e s   t o   g o l a n g   a n d   j s o n p a t h   o u t p u t   f o r m a t s .   M u s t   b e   " n o n e " ,   " s e r v e r " ,   o r   " c l i e n t " .   I f   c l i e n t   s t r a t e g y ,   o n l y   p r i n t   t h e   o b j e c t   t h a t   w o u l d   b e   s e n t ,   w i t h o u t   s e n d i n g   i t .   I f   s e r v e r   s t r a t e g y ,   s u b m i t   s e r v e r - s i d e   r e q u e s t   w i t h o u t   p e r s i s t i n g   t h e   r e s o u r c e .   N a m e   o f   t h e   m a n a g e r   u s e d   t o   t r a c k   f i e l d   o w n e r s h i p .   F i l e n a m e ,   d i r e c t o r y ,   o r   U R L   t o   f i l e s   t h e   r e s o u r c e   t o   u p d a t e   t h e   s u b j e c t s   G r o u p s   t o   b i n d   t o   t h e   r o l e   h e l p   f o r   s u b j e c t   P r o c e s s   t h e   k u s t o m i z a t i o n   d i r e c t o r y .   T h i s   f l a g   c a n ' t   b e   u s e d   t o g e t h e r   w i t h   - f   o r   - R .   I f   t r u e ,   s e t   s u b j e c t   w i l l   N O T   c o n t a c t   a p i - s e r v e r   b u t   r u n   l o c a l l y .   O u t p u t   f o r m a t .   O n e   o f :   ( j s o n ,   y a m l ,   n a m e ,   g o - t e m p l a t e ,   g o - t e m p l a t e - f i l e ,   t e m p l a t e ,   t e m p l a t e f i l e ,   j s o n p a t h ,   j s o n p a t h - a s - j s o n ,   j s o n p a t h - f i l e ) .   P r o c e s s   t h e   d i r e c t o r y   u s e d   i n   - f ,   - - f i l e n a m e   r e c u r s i v e l y .   U s e f u l   w h e n   y o u   w a n t   t o   m a n a g e   r e l a t e d   m a n i f e s t s   o r g a n i z e d   w i t h i n


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   s e t   -   S e t   s p e c i f i c   f e a t u r e s   o n   o b j e c t s   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Managing Service Accounts?

Answer: Managing Service AccountsA ServiceAccount provides an identity for processes that run in a Pod.A process inside a Pod can use the identity of its associated service account to authenticate to the cluster's API server.For an introduction to service accounts, read configure service accounts.This task guide explains some of the concepts behind ServiceAccounts. The guide also explains how to obtain or revoke tokens that represent ServiceAccounts, and how to (optionally) bind a ServiceAccount's validity to the lifetime of an API object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo be able to follow these steps exactly, ensure you have a namespace named examplens. If you don't, create one by running:kubectl create namespace examplens User accounts versus service accountsKubernetes distinguishes between the concept of a user account and a service account for a number of reasons:User accounts are for humans. Service accounts are for application processes, which (for Kubernetes) run in containers that are part of pods.User accounts are intended to be global: names must be unique across all namespaces of a cluster. No matter what namespace you look at, a particular username that represents a user represents the same user. In Kubernetes, service accounts are namespaced: two different namespaces can contain ServiceAccounts that have identical names.Typically, a cluster's user accounts might be synchronised from a corporate database, where new user account creation requires special privileges and is tied to complex business processes. By contrast, service account creation is intended to be more lightweight, allowing cluster users to create service accounts for specific tasks on demand. Separating ServiceAccount creation from the steps to onboard human users makes it easier for workloads to follow the principle of least privilege.Auditing considerations for humans and service accounts may differ; the separation makes that easier to achieve.A configuration bundle for a complex system may include definition of various service accounts for components of that system. Because service accounts can be created without many constraints and have namespaced names, such configuration is usually portable.Bound service account tokensServiceAccount tokens can be bound to API objects that exist in the kube-apiserver. This can be used to tie the validity of a token to the existence of another API object. Supported object types are as follows:Pod (used for projected volume mounts, see below)Secret (can be used to allow revoking a token by deleting the Secret)Node (can be used to auto-revok


Question: How does Managing Service Accounts work?

Answer: Managing Service AccountsA ServiceAccount provides an identity for processes that run in a Pod.A process inside a Pod can use the identity of its associated service account to authenticate to the cluster's API server.For an introduction to service accounts, read configure service accounts.This task guide explains some of the concepts behind ServiceAccounts. The guide also explains how to obtain or revoke tokens that represent ServiceAccounts, and how to (optionally) bind a ServiceAccount's validity to the lifetime of an API object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo be able to follow these steps exactly, ensure you have a namespace named examplens. If you don't, create one by running:kubectl create namespace examplens User accounts versus service accountsKubernetes distinguishes between the concept of a user account and a service account for a number of reasons:User accounts are for humans. Service accounts are for application processes, which (for Kubernetes) run in containers that are part of pods.User accounts are intended to be global: names must be unique across all namespaces of a cluster. No matter what namespace you look at, a particular username that represents a user represents the same user. In Kubernetes, service accounts are namespaced: two different namespaces can contain ServiceAccounts that have identical names.Typically, a cluster's user accounts might be synchronised from a corporate database, where new user account creation requires special privileges and is tied to complex business processes. By contrast, service account creation is intended to be more lightweight, allowing cluster users to create service accounts for specific tasks on demand. Separating ServiceAccount creation from the steps to onboard human users makes it easier for workloads to follow the principle of least privilege.Auditing considerations for humans and service accounts may differ; the separation makes that easier to achieve.A configuration bundle for a complex system may include definition of various service accounts for components of that system. Because service accounts can be created without many constraints and have namespaced names, such configuration is usually portable.Bound service account tokensServiceAccount tokens can be bound to API objects that exist in the kube-apiserver. This can be used to tie the validity of a token to the existence of another API object. Supported object types are as follows:Pod (used for projected volume mounts, see below)Secret (can be used to allow revoking a token by deleting the Secret)Node (can be used to auto-revok


Question: When would you use Managing Service Accounts?

Answer: Managing Service AccountsA ServiceAccount provides an identity for processes that run in a Pod.A process inside a Pod can use the identity of its associated service account to authenticate to the cluster's API server.For an introduction to service accounts, read configure service accounts.This task guide explains some of the concepts behind ServiceAccounts. The guide also explains how to obtain or revoke tokens that represent ServiceAccounts, and how to (optionally) bind a ServiceAccount's validity to the lifetime of an API object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo be able to follow these steps exactly, ensure you have a namespace named examplens. If you don't, create one by running:kubectl create namespace examplens User accounts versus service accountsKubernetes distinguishes between the concept of a user account and a service account for a number of reasons:User accounts are for humans. Service accounts are for application processes, which (for Kubernetes) run in containers that are part of pods.User accounts are intended to be global: names must be unique across all namespaces of a cluster. No matter what namespace you look at, a particular username that represents a user represents the same user. In Kubernetes, service accounts are namespaced: two different namespaces can contain ServiceAccounts that have identical names.Typically, a cluster's user accounts might be synchronised from a corporate database, where new user account creation requires special privileges and is tied to complex business processes. By contrast, service account creation is intended to be more lightweight, allowing cluster users to create service accounts for specific tasks on demand. Separating ServiceAccount creation from the steps to onboard human users makes it easier for workloads to follow the principle of least privilege.Auditing considerations for humans and service accounts may differ; the separation makes that easier to achieve.A configuration bundle for a complex system may include definition of various service accounts for components of that system. Because service accounts can be created without many constraints and have namespaced names, such configuration is usually portable.Bound service account tokensServiceAccount tokens can be bound to API objects that exist in the kube-apiserver. This can be used to tie the validity of a token to the existence of another API object. Supported object types are as follows:Pod (used for projected volume mounts, see below)Secret (can be used to allow revoking a token by deleting the Secret)Node (can be used to auto-revok


Question: What are the benefits of Managing Service Accounts?

Answer: Managing Service AccountsA ServiceAccount provides an identity for processes that run in a Pod.A process inside a Pod can use the identity of its associated service account to authenticate to the cluster's API server.For an introduction to service accounts, read configure service accounts.This task guide explains some of the concepts behind ServiceAccounts. The guide also explains how to obtain or revoke tokens that represent ServiceAccounts, and how to (optionally) bind a ServiceAccount's validity to the lifetime of an API object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo be able to follow these steps exactly, ensure you have a namespace named examplens. If you don't, create one by running:kubectl create namespace examplens User accounts versus service accountsKubernetes distinguishes between the concept of a user account and a service account for a number of reasons:User accounts are for humans. Service accounts are for application processes, which (for Kubernetes) run in containers that are part of pods.User accounts are intended to be global: names must be unique across all namespaces of a cluster. No matter what namespace you look at, a particular username that represents a user represents the same user. In Kubernetes, service accounts are namespaced: two different namespaces can contain ServiceAccounts that have identical names.Typically, a cluster's user accounts might be synchronised from a corporate database, where new user account creation requires special privileges and is tied to complex business processes. By contrast, service account creation is intended to be more lightweight, allowing cluster users to create service accounts for specific tasks on demand. Separating ServiceAccount creation from the steps to onboard human users makes it easier for workloads to follow the principle of least privilege.Auditing considerations for humans and service accounts may differ; the separation makes that easier to achieve.A configuration bundle for a complex system may include definition of various service accounts for components of that system. Because service accounts can be created without many constraints and have namespaced names, such configuration is usually portable.Bound service account tokensServiceAccount tokens can be bound to API objects that exist in the kube-apiserver. This can be used to tie the validity of a token to the existence of another API object. Supported object types are as follows:Pod (used for projected volume mounts, see below)Secret (can be used to allow revoking a token by deleting the Secret)Node (can be used to auto-revok


Question: What is Managing Service Accounts?

Answer: A   S e r v i c e A c c o u n t   p r o v i d e s   a n   i d e n t i t y   f o r   p r o c e s s e s   t h a t   r u n   i n   a   P o d .   A   p r o c e s s   i n s i d e   a   P o d   c a n   u s e   t h e   i d e n t i t y   o f   i t s   a s s o c i a t e d   s e r v i c e   a c c o u n t   t o   a u t h e n t i c a t e   t o   t h e   c l u s t e r ' s   A P I   s e r v e r .   F o r   a n   i n t r o d u c t i o n   t o   s e r v i c e   a c c o u n t s ,   r e a d   c o n f i g u r e   s e r v i c e   a c c o u n t s .   T h i s   t a s k   g u i d e   e x p l a i n s   s o m e   o f   t h e   c o n c e p t s   b e h i n d   S e r v i c e A c c o u n t s .   T h e   g u i d e   a l s o   e x p l a i n s   h o w   t o   o b t a i n   o r   r e v o k e   t o k e n s   t h a t   r e p r e s e n t   S e r v i c e A c c o u n t s ,   a n d   h o w   t o   ( o p t i o n a l l y )   b i n d   a   S e r v i c e A c c o u n t ' s   v a l i d i t y   t o   t h e   l i f e t i m e   o f   a n   A P I   o b j e c t .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   b e   a b l e   t o   f o l l o w   t h e s e   s t e p s   e x a c t l y ,   e n s u r e   y o u   h a v e   a   n a m e s p a c e   n a m e d   e x a m p l e n s .   I f   y o u   d o n ' t ,   c r e a t e   o n e   b y   r u n n i n g :   k u b e c t l   c r e a t e   n a m e s p a c e   e x a m p l e n s


Question: What is User accounts versus service accounts?

Answer: K u b e r n e t e s   d i s t i n g u i s h e s   b e t w e e n   t h e   c o n c e p t   o f   a   u s e r   a c c o u n t   a n d   a   s e r v i c e   a c c o u n t   f o r   a   n u m b e r   o f   r e a s o n s :   U s e r   a c c o u n t s   a r e   f o r   h u m a n s .   S e r v i c e   a c c o u n t s   a r e   f o r   a p p l i c a t i o n   p r o c e s s e s ,   w h i c h   ( f o r   K u b e r n e t e s )   r u n   i n   c o n t a i n e r s   t h a t   a r e   p a r t   o f   p o d s . U s e r   a c c o u n t s   a r e   i n t e n d e d   t o   b e   g l o b a l :   n a m e s   m u s t   b e   u n i q u e   a c r o s s   a l l   n a m e s p a c e s   o f   a   c l u s t e r .   N o   m a t t e r   w h a t   n a m e s p a c e   y o u   l o o k   a t ,   a   p a r t i c u l a r   u s e r n a m e   t h a t   r e p r e s e n t s   a   u s e r   r e p r e s e n t s   t h e   s a m e   u s e r .   I n   K u b e r n e t e s ,   s e r v i c e   a c c o u n t s   a r e   n a m e s p a c e d :   t w o   d i f f e r e n t   n a m e s p a c e s   c a n   c o n t a i n   S e r v i c e A c c o u n t s   t h a t   h a v e   i d e n t i c a l   n a m e s . T y p i c a l l y ,   a   c l u s t e r ' s   u s e r   a c c o u n t s   m i g h t   b e   s y n c h r o n i s e d   f r o m   a   c o r p o r a t e   d a t a b a s e ,   w h e r e   n e w   u s e r   a c c o u n t   c r e a t i o n   r e q u i r e s   s p e c i a l   p r i v i l e g e s   a n d   i s   t i e d   t o   c o m p l e x   b u s i n e s s   p r o c e s s e s .   B y   c o n t r a s t ,   s e r v i c e   a c c o u n t   c r e a t i o n   i s   i n t e n d e d   t o   b e   m o r e   l i g h t w e i g h t ,   a l l o w i n g   c l u s t e r   u s e r s   t o   c r e a t e   s e r v i c e   a c c o u n t s   f o r   s p e c i f i c   t a s k s   o n   d e m a n d .   S e p a r a t i n g   S e r v i c e A c c o u n t   c r e a t i o n   f r o m   t h e   s t e p s   t o   o n b o a r d   h u m a n   u s e r s


Question: What is Bound service account tokens?

Answer: S e r v i c e A c c o u n t   t o k e n s   c a n   b e   b o u n d   t o   A P I   o b j e c t s   t h a t   e x i s t   i n   t h e   k u b e - a p i s e r v e r .   T h i s   c a n   b e   u s e d   t o   t i e   t h e   v a l i d i t y   o f   a   t o k e n   t o   t h e   e x i s t e n c e   o f   a n o t h e r   A P I   o b j e c t .   S u p p o r t e d   o b j e c t   t y p e s   a r e   a s   f o l l o w s :   P o d   ( u s e d   f o r   p r o j e c t e d   v o l u m e   m o u n t s ,   s e e   b e l o w ) S e c r e t   ( c a n   b e   u s e d   t o   a l l o w   r e v o k i n g   a   t o k e n   b y   d e l e t i n g   t h e   S e c r e t ) N o d e   ( c a n   b e   u s e d   t o   a u t o - r e v o k e   a   t o k e n   w h e n   i t s   N o d e   i s   d e l e t e d ;   c r e a t i n g   n e w   n o d e - b o u n d   t o k e n s   i s   G A   i n   v 1 . 3 3 + )   W h e n   a   t o k e n   i s   b o u n d   t o   a n   o b j e c t ,   t h e   o b j e c t ' s   m e t a d a t a . n a m e   a n d   m e t a d a t a . u i d   a r e   s t o r e d   a s   e x t r a   ' p r i v a t e   c l a i m s '   i n   t h e   i s s u e d   J W T .   W h e n   a   b o u n d   t o k e n   i s   p r e s e n t e d   t o   t h e   k u b e - a p i s e r v e r ,   t h e   s e r v i c e   a c c o u n t   a u t h e n t i c a t o r   w i l l   e x t r a c t   a n d   v e r i f y   t h e s e   c l a i m s .   I f   t h e   r e f e r e n c e d   o b j e c t   o r   t h e   S e r v i c e A c c o u n t   i s   p e n d i n g   d e l e t i o n   ( f o r   e x a m p l e ,   d u e   t o   f i n a l i z e r s ) ,   t h e n   f o r   a n y   i n s t a n t   t h a t   i s   6 0   s e c o n d s   ( o r   m o r e )   a f t e r   t h e   . m e t a d a t a . d e l e t i o n T i m e s t a m p   d a t e ,   a u t h e n t i c a t i o n   w i t h   t h a t   t o k e n   w o u l d   f a i l .   I f   t h e   r e f e r e n c e d   o b j e c t   n o   l o n g e r   e x i s t s   ( o r   i t s   m e t a d


Question: What is Additional metadata in Pod bound tokens?

Answer: W h e n   a   s e r v i c e   a c c o u n t   t o k e n   i s   b o u n d   t o   a   P o d   o b j e c t ,   a d d i t i o n a l   m e t a d a t a   i s   a l s o   e m b e d d e d   i n t o   t h e   t o k e n   t h a t   i n d i c a t e s   t h e   v a l u e   o f   t h e   b o u n d   p o d ' s   s p e c . n o d e N a m e   f i e l d ,   a n d   t h e   u i d   o f   t h a t   N o d e ,   i f   a v a i l a b l e .   T h i s   n o d e   i n f o r m a t i o n   i s   n o t   v e r i f i e d   b y   t h e   k u b e - a p i s e r v e r   w h e n   t h e   t o k e n   i s   u s e d   f o r   a u t h e n t i c a t i o n .   I t   i s   i n c l u d e d   s o   i n t e g r a t o r s   d o   n o t   h a v e   t o   f e t c h   P o d   o r   N o d e   A P I   o b j e c t s   t o   c h e c k   t h e   a s s o c i a t e d   N o d e   n a m e   a n d   u i d   w h e n   i n s p e c t i n g   a   J W T .


Question: What is Verifying and inspecting private claims?

Answer: T h e   T o k e n R e v i e w   A P I   c a n   b e   u s e d   t o   v e r i f y   a n d   e x t r a c t   p r i v a t e   c l a i m s   f r o m   a   t o k e n :   F i r s t ,   a s s u m e   y o u   h a v e   a   p o d   n a m e d   t e s t - p o d   a n d   a   s e r v i c e   a c c o u n t   n a m e d   m y - s a . C r e a t e   a   t o k e n   t h a t   i s   b o u n d   t o   t h i s   P o d : k u b e c t l   c r e a t e   t o k e n   m y - s a   - - b o u n d - o b j e c t - k i n d = " P o d "   - - b o u n d - o b j e c t - n a m e = " t e s t - p o d "   C o p y   t h i s   t o k e n   i n t o   a   n e w   f i l e   n a m e d   t o k e n r e v i e w . y a m l : a p i V e r s i o n :   a u t h e n t i c a t i o n . k 8 s . i o / v 1   k i n d :   T o k e n R e v i e w   s p e c :   t o k e n :   < t o k e n   f r o m   s t e p   2 >   S u b m i t   t h i s   r e s o u r c e   t o   t h e   a p i s e r v e r   f o r   r e v i e w : #   u s e   ' - o   y a m l '   t o   i n s p e c t   t h e   o u t p u t   k u b e c t l   c r e a t e   - o   y a m l   - f   t o k e n r e v i e w . y a m l   Y o u   s h o u l d   s e e   a n   o u t p u t   l i k e   b e l o w : a p i V e r s i o n :   a u t h e n t i c a t i o n . k 8 s . i o / v 1   k i n d :   T o k e n R e v i e w   m e t a d a t a :   c r e a t i o n T i m e s t a m p :   n u l l   s p e c :   t o k e n :   < t o k e n >   s t a t u s :   a u d i e n c e s :   -   h t t p s : / / k u b e r n e t e s . d e f a u l t . s v c . c l u s t e r . l o c a l   a u t h e n t i c a t e d :   t r u e   u s e r :   e x t r a :   a u t h e n t i c a t i o n . k u b e r n e t e s . i o / c r e d e n t i a l - i d :   -   J T I = 7 e e 5 2 b e 0 - 9 0 4 5 - 4 6 5 3 - a a 5 e - 0 d a 5 7 b 8 d c c d c   a u t h e n t i c a t i o n . k u b e r n e t e s . i o / n o d e - n a m e :   -   k i n d - c o n t r o l - p l a n e   a u t h e n t i c a t i o n . k u b e r n e t e s . i o / n o d e - u i d :   -   4 9 7 e 9 d 9


Question: What is Schema for service account private claims?

Answer: T h e   s c h e m a   f o r   t h e   K u b e r n e t e s - s p e c i f i c   c l a i m s   w i t h i n   J W T   t o k e n s   i s   n o t   c u r r e n t l y   d o c u m e n t e d ,   h o w e v e r   t h e   r e l e v a n t   c o d e   a r e a   c a n   b e   f o u n d   i n   t h e   s e r v i c e a c c o u n t   p a c k a g e   i n   t h e   K u b e r n e t e s   c o d e b a s e .   Y o u   c a n   i n s p e c t   a   J W T   u s i n g   s t a n d a r d   J W T   d e c o d i n g   t o o l .   B e l o w   i s   a n   e x a m p l e   o f   a   J W T   f o r   t h e   m y - s e r v i c e a c c o u n t   S e r v i c e A c c o u n t ,   b o u n d   t o   a   P o d   o b j e c t   n a m e d   m y - p o d   w h i c h   i s   s c h e d u l e d   t o   t h e   N o d e   m y - n o d e ,   i n   t h e   m y - n a m e s p a c e   n a m e s p a c e :   {   " a u d " :   [   " h t t p s : / / m y - a u d i e n c e . e x a m p l e . c o m "   ] ,   " e x p " :   1 7 2 9 6 0 5 2 4 0 ,   " i a t " :   1 7 2 9 6 0 1 6 4 0 ,   " i s s " :   " h t t p s : / / m y - c l u s t e r . e x a m p l e . c o m " ,   " j t i " :   " a e d 3 4 9 5 4 - b 3 3 a - 4 1 4 2 - b 1 e c - 3 8 9 d 6 b b b 4 9 3 6 " ,   " k u b e r n e t e s . i o " :   {   " n a m e s p a c e " :   " m y - n a m e s p a c e " ,   " n o d e " :   {   " n a m e " :   " m y - n o d e " ,   " u i d " :   " 6 4 6 e 7 c 5 e - 3 2 d 6 - 4 d 4 2 - 9 d b d - e 5 0 4 e 6 c b e 6 b 1 "   } ,   " p o d " :   {   " n a m e " :   " m y - p o d " ,   " u i d " :   " 5 e 0 b d 4 9 b - f 0 4 0 - 4 3 b 0 - 9 9 b 7 - 2 2 7 6 5 a 5 3 f 7 f 3 "   } ,   " s e r v i c e a c c o u n t " :   {   " n a m e " :   " m y - s e r v i c e a c c o u n t " ,   " u i d " :   " 1 4 e e 3 f a 4 - a 7 e 2 - 4 2 0 f - 9 f 9 a - d b c 4 5 0 7 c 3 7 9 8 "   }   } ,   " n b f " :   1 7 2 9 6 0 1 6 4 0 ,   " s u b " :   " s y s t e m : s e r v i c e a c c o u n t : m y - n a m e s p a c e : m y - s e r v i c e a c c o u n t "   }


Question: What is Note:?

Answer: T h e   a u d   a n d   i s s   f i e l d s   i n   t h i s   J W T   m a y   d i f f e r   b e t w e e n   d i f f e r e n t   K u b e r n e t e s   c l u s t e r s   d e p e n d i n g   o n   y o u r   c o n f i g u r a t i o n .   T h e   p r e s e n c e   o f   b o t h   t h e   p o d   a n d   n o d e   c l a i m   i m p l i e s   t h a t   t h i s   t o k e n   i s   b o u n d   t o   a   P o d   o b j e c t .   W h e n   v e r i f y i n g   P o d   b o u n d   S e r v i c e A c c o u n t   t o k e n s ,   t h e   A P I   s e r v e r   d o e s   n o t   v e r i f y   t h e   e x i s t e n c e   o f   t h e   r e f e r e n c e d   N o d e   o b j e c t .   S e r v i c e s   t h a t   r u n   o u t s i d e   o f   K u b e r n e t e s   a n d   w a n t   t o   p e r f o r m   o f f l i n e   v a l i d a t i o n   o f   J W T s   m a y   u s e   t h i s   s c h e m a ,   a l o n g   w i t h   a   c o m p l i a n t   J W T   v a l i d a t o r   c o n f i g u r e d   w i t h   O p e n I D   D i s c o v e r y   i n f o r m a t i o n   f r o m   t h e   A P I   s e r v e r ,   t o   v e r i f y   p r e s e n t e d   J W T s   w i t h o u t   r e q u i r i n g   u s e   o f   t h e   T o k e n R e v i e w   A P I .   S e r v i c e s   t h a t   v e r i f y   J W T s   i n   t h i s   w a y   d o   n o t   v e r i f y   t h e   c l a i m s   e m b e d d e d   i n   t h e   J W T   t o k e n   t o   b e   c u r r e n t   a n d   s t i l l   v a l i d .   T h i s   m e a n s   i f   t h e   t o k e n   i s   b o u n d   t o   a n   o b j e c t ,   a n d   t h a t   o b j e c t   n o   l o n g e r   e x i s t s ,   t h e   t o k e n   w i l l   s t i l l   b e   c o n s i d e r e d   v a l i d   ( u n t i l   t h e   c o n f i g u r e d   t o k e n   e x p i r e s ) .   C l i e n t s   t h a t   r e q u i r e   a s s u r a n c e   t h a t   a   t o k e n ' s   b o u n d   c l a i m s   a r e   s t i l l   v a l i d   M U S T   u s e   t h e   T o k e n R e v i e w   A P I


Question: What is Bound service account token volume mechanism?

Answer: B y   d e f a u l t ,   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   ( s p e c i f i c a l l y ,   t h e   S e r v i c e A c c o u n t   a d m i s s i o n   c o n t r o l l e r )   a d d s   a   p r o j e c t e d   v o l u m e   t o   P o d s ,   a n d   t h i s   v o l u m e   i n c l u d e s   a   t o k e n   f o r   K u b e r n e t e s   A P I   a c c e s s .   H e r e ' s   a n   e x a m p l e   o f   h o w   t h a t   l o o k s   f o r   a   l a u n c h e d   P o d :   . . .   -   n a m e :   k u b e - a p i - a c c e s s - < r a n d o m - s u f f i x >   p r o j e c t e d :   s o u r c e s :   -   s e r v i c e A c c o u n t T o k e n :   p a t h :   t o k e n   #   m u s t   m a t c h   t h e   p a t h   t h e   a p p   e x p e c t s   -   c o n f i g M a p :   i t e m s :   -   k e y :   c a . c r t   p a t h :   c a . c r t   n a m e :   k u b e - r o o t - c a . c r t   -   d o w n w a r d A P I :   i t e m s :   -   f i e l d R e f :   a p i V e r s i o n :   v 1   f i e l d P a t h :   m e t a d a t a . n a m e s p a c e   p a t h :   n a m e s p a c e   T h a t   m a n i f e s t   s n i p p e t   d e f i n e s   a   p r o j e c t e d   v o l u m e   t h a t   c o n s i s t s   o f   t h r e e   s o u r c e s .   I n   t h i s   c a s e ,   e a c h   s o u r c e   a l s o   r e p r e s e n t s   a   s i n g l e   p a t h   w i t h i n   t h a t   v o l u m e .   T h e   t h r e e   s o u r c e s   a r e :   A   s e r v i c e A c c o u n t T o k e n   s o u r c e ,   t h a t   c o n t a i n s   a   t o k e n   t h a t   t h e   k u b e l e t   a c q u i r e s   f r o m   k u b e - a p i s e r v e r .   T h e   k u b e l e t   f e t c h e s   t i m e - b o u n d   t o k e n s   u s i n g   t h e   T o k e n R e q u e s t   A P I .   A   t o k e n   s e r v e d   f o r   a   T o k e n R e q u e s t   e x p i r e s   e i t h e r   w h e n   t h e   p o d   i s   d e l e t e d   o r   a f t e r   a   d e f i n e d   l i f e s p a n   ( b y   d e


Question: What is Manual Secret management for ServiceAccounts?

Answer: V e r s i o n s   o f   K u b e r n e t e s   b e f o r e   v 1 . 2 2   a u t o m a t i c a l l y   c r e a t e d   c r e d e n t i a l s   f o r   a c c e s s i n g   t h e   K u b e r n e t e s   A P I .   T h i s   o l d e r   m e c h a n i s m   w a s   b a s e d   o n   c r e a t i n g   t o k e n   S e c r e t s   t h a t   c o u l d   t h e n   b e   m o u n t e d   i n t o   r u n n i n g   P o d s .   I n   m o r e   r e c e n t   v e r s i o n s ,   i n c l u d i n g   K u b e r n e t e s   v 1 . 3 4 ,   A P I   c r e d e n t i a l s   a r e   o b t a i n e d   d i r e c t l y   u s i n g   t h e   T o k e n R e q u e s t   A P I ,   a n d   a r e   m o u n t e d   i n t o   P o d s   u s i n g   a   p r o j e c t e d   v o l u m e .   T h e   t o k e n s   o b t a i n e d   u s i n g   t h i s   m e t h o d   h a v e   b o u n d e d   l i f e t i m e s ,   a n d   a r e   a u t o m a t i c a l l y   i n v a l i d a t e d   w h e n   t h e   P o d   t h e y   a r e   m o u n t e d   i n t o   i s   d e l e t e d .   Y o u   c a n   s t i l l   m a n u a l l y   c r e a t e   a   S e c r e t   t o   h o l d   a   s e r v i c e   a c c o u n t   t o k e n ;   f o r   e x a m p l e ,   i f   y o u   n e e d   a   t o k e n   t h a t   n e v e r   e x p i r e s .   O n c e   y o u   m a n u a l l y   c r e a t e   a   S e c r e t   a n d   l i n k   i t   t o   a   S e r v i c e A c c o u n t ,   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   a u t o m a t i c a l l y   p o p u l a t e s   t h e   t o k e n   i n t o   t h a t   S e c r e t .


Question: What is Auto-generated legacy ServiceAccount token clean up?

Answer: B e f o r e   v e r s i o n   1 . 2 4 ,   K u b e r n e t e s   a u t o m a t i c a l l y   g e n e r a t e d   S e c r e t - b a s e d   t o k e n s   f o r   S e r v i c e A c c o u n t s .   T o   d i s t i n g u i s h   b e t w e e n   a u t o m a t i c a l l y   g e n e r a t e d   t o k e n s   a n d   m a n u a l l y   c r e a t e d   o n e s ,   K u b e r n e t e s   c h e c k s   f o r   a   r e f e r e n c e   f r o m   t h e   S e r v i c e A c c o u n t ' s   s e c r e t s   f i e l d .   I f   t h e   S e c r e t   i s   r e f e r e n c e d   i n   t h e   s e c r e t s   f i e l d ,   i t   i s   c o n s i d e r e d   a n   a u t o - g e n e r a t e d   l e g a c y   t o k e n .   O t h e r w i s e ,   i t   i s   c o n s i d e r e d   a   m a n u a l l y   c r e a t e d   l e g a c y   t o k e n .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e A c c o u n t   m e t a d a t a :   n a m e :   b u i l d - r o b o t   n a m e s p a c e :   d e f a u l t   s e c r e t s :   -   n a m e :   b u i l d - r o b o t - s e c r e t   #   u s u a l l y   N O T   p r e s e n t   f o r   a   m a n u a l l y   g e n e r a t e d   t o k e n   B e g i n n i n g   f r o m   v e r s i o n   1 . 2 9 ,   l e g a c y   S e r v i c e A c c o u n t   t o k e n s   t h a t   w e r e   g e n e r a t e d   a u t o m a t i c a l l y   w i l l   b e   m a r k e d   a s   i n v a l i d   i f   t h e y   r e m a i n   u n u s e d   f o r   a   c e r t a i n   p e r i o d   o f   t i m e   ( s e t   t o   d e f a u l t   a t   o n e   y e a r ) .   T o k e n s   t h a t   c o n t i n u e   t o   b e   u n u s e d   f o r   t h i s   d e f i n e d   p e r i o d   ( a g a i n ,   b y   d e f a u l t ,   o n e   y e a r )   w i l l   s u b s e q u e n t l y   b e   p u r g e d   b y   t h e   c o n t r o l   p l a n e .   I f   u s e r s   u s e   a n   i n v a l i d a t e d   a u t o - g e n e r a t e d   t o k e n ,   t h e   t o k e n   v a l i d


Question: What is ServiceAccount controller?

Answer: A   S e r v i c e A c c o u n t   c o n t r o l l e r   m a n a g e s   t h e   S e r v i c e A c c o u n t s   i n s i d e   n a m e s p a c e s ,   a n d   e n s u r e s   a   S e r v i c e A c c o u n t   n a m e d   " d e f a u l t "   e x i s t s   i n   e v e r y   a c t i v e   n a m e s p a c e .


Question: What is Token controller?

Answer: T h e   s e r v i c e   a c c o u n t   t o k e n   c o n t r o l l e r   r u n s   a s   p a r t   o f   k u b e - c o n t r o l l e r - m a n a g e r .   T h i s   c o n t r o l l e r   a c t s   a s y n c h r o n o u s l y .   I t :   w a t c h e s   f o r   S e r v i c e A c c o u n t   d e l e t i o n   a n d   d e l e t e s   a l l   c o r r e s p o n d i n g   S e r v i c e A c c o u n t   t o k e n   S e c r e t s . w a t c h e s   f o r   S e r v i c e A c c o u n t   t o k e n   S e c r e t   a d d i t i o n ,   a n d   e n s u r e s   t h e   r e f e r e n c e d   S e r v i c e A c c o u n t   e x i s t s ,   a n d   a d d s   a   t o k e n   t o   t h e   S e c r e t   i f   n e e d e d . w a t c h e s   f o r   S e c r e t   d e l e t i o n   a n d   r e m o v e s   a   r e f e r e n c e   f r o m   t h e   c o r r e s p o n d i n g   S e r v i c e A c c o u n t   i f   n e e d e d .   Y o u   m u s t   p a s s   a   s e r v i c e   a c c o u n t   p r i v a t e   k e y   f i l e   t o   t h e   t o k e n   c o n t r o l l e r   i n   t h e   k u b e - c o n t r o l l e r - m a n a g e r   u s i n g   t h e   - - s e r v i c e - a c c o u n t - p r i v a t e - k e y - f i l e   f l a g .   T h e   p r i v a t e   k e y   i s   u s e d   t o   s i g n   g e n e r a t e d   s e r v i c e   a c c o u n t   t o k e n s .   S i m i l a r l y ,   y o u   m u s t   p a s s   t h e   c o r r e s p o n d i n g   p u b l i c   k e y   t o   t h e   k u b e - a p i s e r v e r   u s i n g   t h e   - - s e r v i c e - a c c o u n t - k e y - f i l e   f l a g .   T h e   p u b l i c   k e y   w i l l   b e   u s e d   t o   v e r i f y   t h e   t o k e n s   d u r i n g   a u t h e n t i c a t i o n .   A n   a l t e r n a t e   s e t u p   t o   s e t t i n g   - - s e r v i c e - a c c o u n t - p r i v a t e - k e y - f i l e   a n d   - - s e r v i c e - a c c o u n t - k e y - f i l e   f l a g s   i s   t o   c o n f i g u r e   a n   e x t e r n a l   J W


Question: What is ServiceAccount admission controller?

Answer: T h e   m o d i f i c a t i o n   o f   p o d s   i s   i m p l e m e n t e d   v i a   a   p l u g i n   c a l l e d   a n   A d m i s s i o n   C o n t r o l l e r .   I t   i s   p a r t   o f   t h e   A P I   s e r v e r .   T h i s   a d m i s s i o n   c o n t r o l l e r   a c t s   s y n c h r o n o u s l y   t o   m o d i f y   p o d s   a s   t h e y   a r e   c r e a t e d .   W h e n   t h i s   p l u g i n   i s   a c t i v e   ( a n d   i t   i s   b y   d e f a u l t   o n   m o s t   d i s t r i b u t i o n s ) ,   t h e n   i t   d o e s   t h e   f o l l o w i n g   w h e n   a   P o d   i s   c r e a t e d :   I f   t h e   p o d   d o e s   n o t   h a v e   a   . s p e c . s e r v i c e A c c o u n t N a m e   s e t ,   t h e   a d m i s s i o n   c o n t r o l l e r   s e t s   t h e   n a m e   o f   t h e   S e r v i c e A c c o u n t   f o r   t h i s   i n c o m i n g   P o d   t o   d e f a u l t . T h e   a d m i s s i o n   c o n t r o l l e r   e n s u r e s   t h a t   t h e   S e r v i c e A c c o u n t   r e f e r e n c e d   b y   t h e   i n c o m i n g   P o d   e x i s t s .   I f   t h e r e   i s   n o   S e r v i c e A c c o u n t   w i t h   a   m a t c h i n g   n a m e ,   t h e   a d m i s s i o n   c o n t r o l l e r   r e j e c t s   t h e   i n c o m i n g   P o d .   T h a t   c h e c k   a p p l i e s   e v e n   f o r   t h e   d e f a u l t   S e r v i c e A c c o u n t . P r o v i d e d   t h a t   n e i t h e r   t h e   S e r v i c e A c c o u n t ' s   a u t o m o u n t S e r v i c e A c c o u n t T o k e n   f i e l d   n o r   t h e   P o d ' s   a u t o m o u n t S e r v i c e A c c o u n t T o k e n   f i e l d   i s   s e t   t o   f a l s e : t h e   a d m i s s i o n   c o n t r o l l e r   m u t a t e s   t h e   i n c o m i n g   P o d ,   a d d i n g   a n   e x t r a   v o l u m e   t h a t   c o n t a i n s   a   t o k e n   f o r   A P I   a c c e s s . t h e   a d m i s s i o n   c o n t r o l l


Question: What is Legacy ServiceAccount token tracking controller?

Answer: T h i s   c o n t r o l l e r   g e n e r a t e s   a   C o n f i g M a p   c a l l e d   k u b e - s y s t e m / k u b e - a p i s e r v e r - l e g a c y - s e r v i c e - a c c o u n t - t o k e n - t r a c k i n g   i n   t h e   k u b e - s y s t e m   n a m e s p a c e .   T h e   C o n f i g M a p   r e c o r d s   t h e   t i m e s t a m p   w h e n   l e g a c y   s e r v i c e   a c c o u n t   t o k e n s   b e g a n   t o   b e   m o n i t o r e d   b y   t h e   s y s t e m .


Question: What is Legacy ServiceAccount token cleaner?

Answer: T h e   l e g a c y   S e r v i c e A c c o u n t   t o k e n   c l e a n e r   r u n s   a s   p a r t   o f   t h e   k u b e - c o n t r o l l e r - m a n a g e r   a n d   c h e c k s   e v e r y   2 4   h o u r s   t o   s e e   i f   a n y   a u t o - g e n e r a t e d   l e g a c y   S e r v i c e A c c o u n t   t o k e n   h a s   n o t   b e e n   u s e d   i n   a   s p e c i f i e d   a m o u n t   o f   t i m e .   I f   s o ,   t h e   c l e a n e r   m a r k s   t h o s e   t o k e n s   a s   i n v a l i d .   T h e   c l e a n e r   w o r k s   b y   f i r s t   c h e c k i n g   t h e   C o n f i g M a p   c r e a t e d   b y   t h e   c o n t r o l   p l a n e   ( p r o v i d e d   t h a t   L e g a c y S e r v i c e A c c o u n t T o k e n T r a c k i n g   i s   e n a b l e d ) .   I f   t h e   c u r r e n t   t i m e   i s   a   s p e c i f i e d   a m o u n t   o f   t i m e   a f t e r   t h e   d a t e   i n   t h e   C o n f i g M a p ,   t h e   c l e a n e r   t h e n   l o o p s   t h r o u g h   t h e   l i s t   o f   S e c r e t s   i n   t h e   c l u s t e r   a n d   e v a l u a t e s   e a c h   S e c r e t   t h a t   h a s   t h e   t y p e   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t - t o k e n .   I f   a   S e c r e t   m e e t s   a l l   o f   t h e   f o l l o w i n g   c o n d i t i o n s ,   t h e   c l e a n e r   m a r k s   i t   a s   i n v a l i d :   T h e   S e c r e t   i s   a u t o - g e n e r a t e d ,   m e a n i n g   t h a t   i t   i s   b i - d i r e c t i o n a l l y   r e f e r e n c e d   b y   a   S e r v i c e A c c o u n t . T h e   S e c r e t   i s   n o t   c u r r e n t l y   m o u n t e d   b y   a n y   p o d s . T h e   S e c r e t   h a s   n o t   b e e n   u s e d   i n   a   s p e c i f i e d   a m o u n t   o f   t i m e   s i n c e   i t   w a s   c r e a t e d   o r   s i n c e   i t   w a s   l a s t   u s e d .   T h e   c l e a n e r   m a r k s   a   S e c r e t


Question: What is TokenRequest API?

Answer: Y o u   u s e   t h e   T o k e n R e q u e s t   s u b r e s o u r c e   o f   a   S e r v i c e A c c o u n t   t o   o b t a i n   a   t i m e - b o u n d   t o k e n   f o r   t h a t   S e r v i c e A c c o u n t .   Y o u   d o n ' t   n e e d   t o   c a l l   t h i s   t o   o b t a i n   a n   A P I   t o k e n   f o r   u s e   w i t h i n   a   c o n t a i n e r ,   s i n c e   t h e   k u b e l e t   s e t s   t h i s   u p   f o r   y o u   u s i n g   a   p r o j e c t e d   v o l u m e .   I f   y o u   w a n t   t o   u s e   t h e   T o k e n R e q u e s t   A P I   f r o m   k u b e c t l ,   s e e   M a n u a l l y   c r e a t e   a n   A P I   t o k e n   f o r   a   S e r v i c e A c c o u n t .   T h e   K u b e r n e t e s   c o n t r o l   p l a n e   ( s p e c i f i c a l l y ,   t h e   S e r v i c e A c c o u n t   a d m i s s i o n   c o n t r o l l e r )   a d d s   a   p r o j e c t e d   v o l u m e   t o   P o d s ,   a n d   t h e   k u b e l e t   e n s u r e s   t h a t   t h i s   v o l u m e   c o n t a i n s   a   t o k e n   t h a t   l e t s   c o n t a i n e r s   a u t h e n t i c a t e   a s   t h e   r i g h t   S e r v i c e A c c o u n t .   ( T h i s   m e c h a n i s m   s u p e r s e d e d   a n   e a r l i e r   m e c h a n i s m   t h a t   a d d e d   a   v o l u m e   b a s e d   o n   a   S e c r e t ,   w h e r e   t h e   S e c r e t   r e p r e s e n t e d   t h e   S e r v i c e A c c o u n t   f o r   t h e   P o d   b u t   d i d   n o t   e x p i r e . )   H e r e ' s   a n   e x a m p l e   o f   h o w   t h a t   l o o k s   f o r   a   l a u n c h e d   P o d :   . . .   -   n a m e :   k u b e - a p i - a c c e s s - < r a n d o m - s u f f i x >   p r o j e c t e d :   d e f a u l t M o d e :   4 2 0   #   d e c i m a l   e q u i v a l e n t   o f   o c t a l   0 6 4 4   s o u r c e s :   -   s e r v i c e A c c o u n t T o k e n :   e x p i r a t i o n S e c o n d s :   3 6 0 7   p a t h :   t o k e


Question: What is Caution:?

Answer: T o   c r e a t e   a   n o n - e x p i r i n g ,   p e r s i s t e d   A P I   t o k e n   f o r   a   S e r v i c e A c c o u n t ,   c r e a t e   a   S e c r e t   o f   t y p e   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t - t o k e n   w i t h   a n   a n n o t a t i o n   r e f e r e n c i n g   t h e   S e r v i c e A c c o u n t .   T h e   c o n t r o l   p l a n e   t h e n   g e n e r a t e s   a   l o n g - l i v e d   t o k e n   a n d   u p d a t e s   t h a t   S e c r e t   w i t h   t h a t   g e n e r a t e d   t o k e n   d a t a .   H e r e   i s   a   s a m p l e   m a n i f e s t   f o r   s u c h   a   S e c r e t :   a p i V e r s i o n :   v 1   k i n d :   S e c r e t   t y p e :   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t - t o k e n   m e t a d a t a :   n a m e :   m y s e c r e t n a m e   a n n o t a t i o n s :   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t . n a m e :   m y s e r v i c e a c c o u n t   T o   c r e a t e   a   S e c r e t   b a s e d   o n   t h i s   e x a m p l e ,   r u n :   k u b e c t l   - n   e x a m p l e n s   c r e a t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / s e c r e t / s e r v i c e a c c o u n t / m y s e c r e t n a m e . y a m l   T o   s e e   t h e   d e t a i l s   f o r   t h a t   S e c r e t ,   r u n :   k u b e c t l   - n   e x a m p l e n s   d e s c r i b e   s e c r e t   m y s e c r e t n a m e   T h e   o u t p u t   i s   s i m i l a r   t o :   N a m e :   m y s e c r e t n a m e   N a m e s p a c e :   e x a m p l e n s   L a b e l s :   < n o n e >   A n n o t a t i o n s :   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t . n a m e = m y s e r v i c e a c c o u n t   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t . u i d = 8 a 8 5 c 4 c 4 - 8 4 8 3 - 1 1 e 9 - b c 4 2 - 5 2 6 a f 7 7 6 4 f 6 4   T y p e :   k u b e r n e t e s . i o / s e r v i c e - a c c o u n t - t o k e n   D a t a   = = = =   c


Question: What is Delete/invalidate a long-lived/legacy ServiceAccount token?

Answer: I f   y o u   k n o w   t h e   n a m e   o f   t h e   S e c r e t   t h a t   c o n t a i n s   t h e   t o k e n   y o u   w a n t   t o   r e m o v e :   k u b e c t l   d e l e t e   s e c r e t   n a m e - o f - s e c r e t   O t h e r w i s e ,   f i r s t   f i n d   t h e   S e c r e t   f o r   t h e   S e r v i c e A c c o u n t .   #   T h i s   a s s u m e s   t h a t   y o u   a l r e a d y   h a v e   a   n a m e s p a c e   n a m e d   ' e x a m p l e n s '   k u b e c t l   - n   e x a m p l e n s   g e t   s e r v i c e a c c o u n t / e x a m p l e - a u t o m a t e d - t h i n g   - o   y a m l   T h e   o u t p u t   i s   s i m i l a r   t o :   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e A c c o u n t   m e t a d a t a :   a n n o t a t i o n s :   k u b e c t l . k u b e r n e t e s . i o / l a s t - a p p l i e d - c o n f i g u r a t i o n :   |   { " a p i V e r s i o n " : " v 1 " , " k i n d " : " S e r v i c e A c c o u n t " , " m e t a d a t a " : { " a n n o t a t i o n s " : { } , " n a m e " : " e x a m p l e - a u t o m a t e d - t h i n g " , " n a m e s p a c e " : " e x a m p l e n s " } }   c r e a t i o n T i m e s t a m p :   " 2 0 1 9 - 0 7 - 2 1 T 0 7 : 0 7 : 0 7 Z "   n a m e :   e x a m p l e - a u t o m a t e d - t h i n g   n a m e s p a c e :   e x a m p l e n s   r e s o u r c e V e r s i o n :   " 7 7 7 "   s e l f L i n k :   / a p i / v 1 / n a m e s p a c e s / e x a m p l e n s / s e r v i c e a c c o u n t s / e x a m p l e - a u t o m a t e d - t h i n g   u i d :   f 2 3 f d 1 7 0 - 6 6 f 2 - 4 6 9 7 - b 0 4 9 - e 1 e 2 6 6 b 7 f 8 3 5   s e c r e t s :   -   n a m e :   e x a m p l e - a u t o m a t e d - t h i n g - t o k e n - z y x w v   T h e n ,   d e l e t e   t h e   S e c r e t   y o u   n o w   k n o w   t h e   n a m e   o f :   k u b e c t l   - n   e x a m p l e n s   d e l e t e   s e c r e t / e x a m p l e - a u t o m a t e d - t h i n g - t o k e n - z y x w v


Question: What is Delete/invalidate a short-lived ServiceAccount token?

Answer: S h o r t   l i v e d   S e r v i c e A c c o u n t   t o k e n s   a u t o m a t i c a l l y   e x p i r e   a f t e r   t h e   t i m e - l i m i t   s p e c i f i e d   d u r i n g   t h e i r   c r e a t i o n .   T h e r e   i s   n o   c e n t r a l   r e c o r d   o f   t o k e n s   i s s u e d ,   s o   t h e r e   i s   n o   w a y   t o   r e v o k e   i n d i v i d u a l   t o k e n s .   I f   y o u   h a v e   t o   r e v o k e   a   s h o r t - l i v e d   t o k e n   b e f o r e   i t s   e x p i r a t i o n ,   y o u   c a n   d e l e t e   a n d   r e - c r e a t e   t h e   S e r v i c e A c c o u n t   i t   i s   a s s o c i a t e d   t o .   T h i s   w i l l   c h a n g e   i t s   U I D   a n d   h e n c e   i n v a l i d a t e   a l l   S e r v i c e A c c o u n t   t o k e n s   t h a t   w e r e   c r e a t e d   f o r   i t .


Question: What is External ServiceAccount token signing and key management?

Answer: T h e   k u b e - a p i s e r v e r   c a n   b e   c o n f i g u r e d   t o   u s e   e x t e r n a l   s i g n e r   f o r   t o k e n   s i g n i n g   a n d   t o k e n   v e r i f y i n g   k e y   m a n a g e m e n t .   T h i s   f e a t u r e   e n a b l e s   k u b e r n e t e s   d i s t r i b u t i o n s   t o   i n t e g r a t e   w i t h   k e y   m a n a g e m e n t   s o l u t i o n s   o f   t h e i r   c h o i c e   ( f o r   e x a m p l e ,   H S M s ,   c l o u d   K M S e s )   f o r   s e r v i c e   a c c o u n t   c r e d e n t i a l   s i g n i n g   a n d   v e r i f i c a t i o n .   T o   c o n f i g u r e   k u b e - a p i s e r v e r   t o   u s e   e x t e r n a l - j w t - s i g n e r   s e t   t h e   - - s e r v i c e - a c c o u n t - s i g n i n g - e n d p o i n t   f l a g   t o   t h e   l o c a t i o n   o f   a   U n i x   d o m a i n   s o c k e t   ( U D S )   o n   a   f i l e s y s t e m ,   o r   b e   p r e f i x e d   w i t h   a n   @   s y m b o l   a n d   n a m e   a   U D S   i n   t h e   a b s t r a c t   s o c k e t   n a m e s p a c e .   A t   t h e   c o n f i g u r e d   U D S   s h a l l   b e   a n   R P C   s e r v e r   w h i c h   i m p l e m e n t s   a n   E x t e r n a l J W T S i g n e r   g R P C   s e r v i c e .   T h e   e x t e r n a l - j w t - s i g n e r   m u s t   b e   h e a l t h y   a n d   b e   r e a d y   t o   s e r v e   s u p p o r t e d   s e r v i c e   a c c o u n t   k e y s   f o r   t h e   k u b e - a p i s e r v e r   t o   s t a r t .


Question: What is Note:?

Answer: A n   e x t e r n a l   s i g n e r   p r o v i d e s   a   v 1 . E x t e r n a l J W T S i g n e r   g R P C   s e r v i c e   t h a t   i m p l e m e n t s   3   m e t h o d s :


Question: What is Metadata?

Answer: M e t a d a t a   i s   m e a n t   t o   b e   c a l l e d   o n c e   b y   k u b e - a p i s e r v e r   o n   s t a r t u p .   T h i s   e n a b l e s   t h e   e x t e r n a l   s i g n e r   t o   s h a r e   m e t a d a t a   w i t h   k u b e - a p i s e r v e r ,   l i k e   t h e   m a x   t o k e n   l i f e t i m e   t h a t   s i g n e r   s u p p o r t s .   r p c   M e t a d a t a ( M e t a d a t a R e q u e s t )   r e t u r n s   ( M e t a d a t a R e s p o n s e )   { }   m e s s a g e   M e t a d a t a R e q u e s t   { }   m e s s a g e   M e t a d a t a R e s p o n s e   {   / /   u s e d   b y   k u b e - a p i s e r v e r   f o r   d e f a u l t i n g / v a l i d a t i o n   o f   J W T   l i f e t i m e   w h i l e   a c c o u n t i n g   f o r   c o n f i g u r a t i o n   f l a g   v a l u e s :   / /   1 .   ` - - s e r v i c e - a c c o u n t - m a x - t o k e n - e x p i r a t i o n `   / /   2 .   ` - - s e r v i c e - a c c o u n t - e x t e n d - t o k e n - e x p i r a t i o n `   / /   / /   *   I f   ` - - s e r v i c e - a c c o u n t - m a x - t o k e n - e x p i r a t i o n `   i s   g r e a t e r   t h a n   ` m a x _ t o k e n _ e x p i r a t i o n _ s e c o n d s ` ,   k u b e - a p i s e r v e r   t r e a t s   t h a t   a s   m i s c o n f i g u r a t i o n   a n d   e x i t s .   / /   *   I f   ` - - s e r v i c e - a c c o u n t - m a x - t o k e n - e x p i r a t i o n `   i s   n o t   e x p l i c i t l y   s e t ,   k u b e - a p i s e r v e r   d e f a u l t s   t o   ` m a x _ t o k e n _ e x p i r a t i o n _ s e c o n d s ` .   / /   *   I f   ` - - s e r v i c e - a c c o u n t - e x t e n d - t o k e n - e x p i r a t i o n `   i s   t r u e ,   t h e   e x t e n d e d   e x p i r a t i o n   i s   ` m i n ( 1   y e a r ,   m a x _ t o k e n _ e x p i r a t i o n _ s e c o n d s ) ` .   / /   / /   ` m a x _ t o k e n _ e x p i r a t i o n _ s e c o n d s `   m u s t   b e   a t   l e a s t   6 0 0 s .   i n t


Question: What is FetchKeys?

Answer: F e t c h K e y s   r e t u r n s   t h e   s e t   o f   p u b l i c   k e y s   t h a t   a r e   t r u s t e d   t o   s i g n   K u b e r n e t e s   s e r v i c e   a c c o u n t   t o k e n s .   K u b e - a p i s e r v e r   w i l l   c a l l   t h i s   R P C :   E v e r y   t i m e   i t   t r i e s   t o   v a l i d a t e   a   J W T   f r o m   t h e   s e r v i c e   a c c o u n t   i s s u e r   w i t h   a n   u n k n o w n   k e y   I D ,   a n d P e r i o d i c a l l y ,   s o   i t   c a n   s e r v e   r e a s o n a b l y - u p - t o - d a t e   k e y s   f r o m   t h e   O I D C   J W K s   e n d p o i n t .   r p c   F e t c h K e y s ( F e t c h K e y s R e q u e s t )   r e t u r n s   ( F e t c h K e y s R e s p o n s e )   { }   m e s s a g e   F e t c h K e y s R e q u e s t   { }   m e s s a g e   F e t c h K e y s R e s p o n s e   {   r e p e a t e d   K e y   k e y s   =   1 ;   / /   T h e   t i m e s t a m p   w h e n   t h i s   d a t a   w a s   p u l l e d   f r o m   t h e   a u t h o r i t a t i v e   s o u r c e   o f   / /   t r u t h   f o r   v e r i f i c a t i o n   k e y s .   / /   k u b e - a p i s e r v e r   c a n   e x p o r t   t h i s   f r o m   m e t r i c s ,   t o   e n a b l e   e n d - t o - e n d   S L O s .   g o o g l e . p r o t o b u f . T i m e s t a m p   d a t a _ t i m e s t a m p   =   2 ;   / /   r e f r e s h   i n t e r v a l   f o r   v e r i f i c a t i o n   k e y s   t o   p i c k   c h a n g e s   i f   a n y .   / /   a n y   v a l u e   < =   0   i s   c o n s i d e r e d   a   m i s c o n f i g u r a t i o n .   i n t 6 4   r e f r e s h _ h i n t _ s e c o n d s   =   3 ;   }   m e s s a g e   K e y   {   / /   A   u n i q u e   i d e n t i f i e r   f o r   t h i s   k e y .   / /   L e n g t h   m u s t   b e   < = 1 0 2 4 .   s t r i n g   k e y _ i d   =   1 ;   / /   T h e   p u b l i c   k e y ,   P K I X - s e r i a l i z e d .   / /   m u s t   b e   a   p u b l i c   k e y   s u