Question: What is SSH authentication Secrets?

Answer: T h e   b u i l t i n   t y p e   k u b e r n e t e s . i o / s s h - a u t h   i s   p r o v i d e d   f o r   s t o r i n g   d a t a   u s e d   i n   S S H   a u t h e n t i c a t i o n .   W h e n   u s i n g   t h i s   S e c r e t   t y p e ,   y o u   w i l l   h a v e   t o   s p e c i f y   a   s s h - p r i v a t e k e y   k e y - v a l u e   p a i r   i n   t h e   d a t a   ( o r   s t r i n g D a t a )   f i e l d   a s   t h e   S S H   c r e d e n t i a l   t o   u s e .   T h e   f o l l o w i n g   m a n i f e s t   i s   a n   e x a m p l e   o f   a   S e c r e t   u s e d   f o r   S S H   p u b l i c / p r i v a t e   k e y   a u t h e n t i c a t i o n :   a p i V e r s i o n :   v 1   k i n d :   S e c r e t   m e t a d a t a :   n a m e :   s e c r e t - s s h - a u t h   t y p e :   k u b e r n e t e s . i o / s s h - a u t h   d a t a :   #   t h e   d a t a   i s   a b b r e v i a t e d   i n   t h i s   e x a m p l e   s s h - p r i v a t e k e y :   |   U G 9 1 c m l u Z z Y l R W 1 v d G l j b 2 4 l U 2 N 1 Y m E =   T h e   S S H   a u t h e n t i c a t i o n   S e c r e t   t y p e   i s   p r o v i d e d   o n l y   f o r   c o n v e n i e n c e .   Y o u   c a n   c r e a t e   a n   O p a q u e   t y p e   f o r   c r e d e n t i a l s   u s e d   f o r   S S H   a u t h e n t i c a t i o n .   H o w e v e r ,   u s i n g   t h e   d e f i n e d   a n d   p u b l i c   S e c r e t   t y p e   ( k u b e r n e t e s . i o / s s h - a u t h )   h e l p s   o t h e r   p e o p l e   t o   u n d e r s t a n d   t h e   p u r p o s e   o f   y o u r   S e c r e t ,   a n d   s e t s   a   c o n v e n t i o n   f o r   w h a t   k e y   n a m e s   t o   e x p e c t .   T h e   K u b e r n e t e s   A P I   v e r i f i e s   t h a t   t h e   r e q u i r e d   k e y s   a r e   s e t   f o r   a   S e c r e t   o f   t h i s   t y p e .


Question: What is TLS Secrets?

Answer: T h e   k u b e r n e t e s . i o / t l s   S e c r e t   t y p e   i s   f o r   s t o r i n g   a   c e r t i f i c a t e   a n d   i t s   a s s o c i a t e d   k e y   t h a t   a r e   t y p i c a l l y   u s e d   f o r   T L S .   O n e   c o m m o n   u s e   f o r   T L S   S e c r e t s   i s   t o   c o n f i g u r e   e n c r y p t i o n   i n   t r a n s i t   f o r   a n   I n g r e s s ,   b u t   y o u   c a n   a l s o   u s e   i t   w i t h   o t h e r   r e s o u r c e s   o r   d i r e c t l y   i n   y o u r   w o r k l o a d .   W h e n   u s i n g   t h i s   t y p e   o f   S e c r e t ,   t h e   t l s . k e y   a n d   t h e   t l s . c r t   k e y   m u s t   b e   p r o v i d e d   i n   t h e   d a t a   ( o r   s t r i n g D a t a )   f i e l d   o f   t h e   S e c r e t   c o n f i g u r a t i o n ,   a l t h o u g h   t h e   A P I   s e r v e r   d o e s n ' t   a c t u a l l y   v a l i d a t e   t h e   v a l u e s   f o r   e a c h   k e y .   A s   a n   a l t e r n a t i v e   t o   u s i n g   s t r i n g D a t a ,   y o u   c a n   u s e   t h e   d a t a   f i e l d   t o   p r o v i d e   t h e   b a s e 6 4   e n c o d e d   c e r t i f i c a t e   a n d   p r i v a t e   k e y .   F o r   d e t a i l s ,   s e e   C o n s t r a i n t s   o n   S e c r e t   n a m e s   a n d   d a t a .   T h e   f o l l o w i n g   Y A M L   c o n t a i n s   a n   e x a m p l e   c o n f i g   f o r   a   T L S   S e c r e t :   a p i V e r s i o n :   v 1   k i n d :   S e c r e t   m e t a d a t a :   n a m e :   s e c r e t - t l s   t y p e :   k u b e r n e t e s . i o / t l s   d a t a :   #   v a l u e s   a r e   b a s e 6 4   e n c o d e d ,   w h i c h   o b s c u r e s   t h e m   b u t   d o e s   N O T   p r o v i d e   #   a n y   u s e f u l   l e v e l   o f   c o n f i d e n t i a l i t y   #   R e p l a c e   t h e   f o l l o w i n g   v a l u e s   w i t h   y o u r   o w n   b a s e 6 4 - e n c o d e d   c e r t i


Question: What is Bootstrap token Secrets?

Answer: T h e   b o o t s t r a p . k u b e r n e t e s . i o / t o k e n   S e c r e t   t y p e   i s   f o r   t o k e n s   u s e d   d u r i n g   t h e   n o d e   b o o t s t r a p   p r o c e s s .   I t   s t o r e s   t o k e n s   u s e d   t o   s i g n   w e l l - k n o w n   C o n f i g M a p s .   A   b o o t s t r a p   t o k e n   S e c r e t   i s   u s u a l l y   c r e a t e d   i n   t h e   k u b e - s y s t e m   n a m e s p a c e   a n d   n a m e d   i n   t h e   f o r m   b o o t s t r a p - t o k e n - < t o k e n - i d >   w h e r e   < t o k e n - i d >   i s   a   6   c h a r a c t e r   s t r i n g   o f   t h e   t o k e n   I D .   A s   a   K u b e r n e t e s   m a n i f e s t ,   a   b o o t s t r a p   t o k e n   S e c r e t   m i g h t   l o o k   l i k e   t h e   f o l l o w i n g :   a p i V e r s i o n :   v 1   k i n d :   S e c r e t   m e t a d a t a :   n a m e :   b o o t s t r a p - t o k e n - 5 e m i t j   n a m e s p a c e :   k u b e - s y s t e m   t y p e :   b o o t s t r a p . k u b e r n e t e s . i o / t o k e n   d a t a :   a u t h - e x t r a - g r o u p s :   c 3 l z d G V t O m J v b 3 R z d H J h c H B l c n M 6 a 3 V i Z W F k b T p k Z W Z h d W x 0 L W 5 v Z G U t d G 9 r Z W 4 =   e x p i r a t i o n :   M j A y M C 0 w O S 0 x M 1 Q w N D o z O T o x M F o =   t o k e n - i d :   N W V t a X R q   t o k e n - s e c r e t :   a 3 E 0 Z 2 l o d n N 6 e m d u M X A w c g = =   u s a g e - b o o t s t r a p - a u t h e n t i c a t i o n :   d H J 1 Z Q = =   u s a g e - b o o t s t r a p - s i g n i n g :   d H J 1 Z Q = =   A   b o o t s t r a p   t o k e n   S e c r e t   h a s   t h e   f o l l o w i n g   k e y s   s p e c i f i e d   u n d e r   d a t a :   t o k e n - i d :   A   r a n d o m   6   c h a r a c t e r   s t r i n g   a s   t h e   t o k e n   i d e n t i f i e r .   R e q u i r e d . t o k e n - s e c r e t :   A   r a n d o m   1 6   c h a r a c t e r   s t r i n g   a s   t h e   a c t


Question: What is Creating a Secret?

Answer: T h e r e   a r e   s e v e r a l   o p t i o n s   t o   c r e a t e   a   S e c r e t :   U s e   k u b e c t l U s e   a   c o n f i g u r a t i o n   f i l e U s e   t h e   K u s t o m i z e   t o o l


Question: What is Constraints on Secret names and data?

Answer: T h e   n a m e   o f   a   S e c r e t   o b j e c t   m u s t   b e   a   v a l i d   D N S   s u b d o m a i n   n a m e .   Y o u   c a n   s p e c i f y   t h e   d a t a   a n d / o r   t h e   s t r i n g D a t a   f i e l d   w h e n   c r e a t i n g   a   c o n f i g u r a t i o n   f i l e   f o r   a   S e c r e t .   T h e   d a t a   a n d   t h e   s t r i n g D a t a   f i e l d s   a r e   o p t i o n a l .   T h e   v a l u e s   f o r   a l l   k e y s   i n   t h e   d a t a   f i e l d   h a v e   t o   b e   b a s e 6 4 - e n c o d e d   s t r i n g s .   I f   t h e   c o n v e r s i o n   t o   b a s e 6 4   s t r i n g   i s   n o t   d e s i r a b l e ,   y o u   c a n   c h o o s e   t o   s p e c i f y   t h e   s t r i n g D a t a   f i e l d   i n s t e a d ,   w h i c h   a c c e p t s   a r b i t r a r y   s t r i n g s   a s   v a l u e s .   T h e   k e y s   o f   d a t a   a n d   s t r i n g D a t a   m u s t   c o n s i s t   o f   a l p h a n u m e r i c   c h a r a c t e r s ,   - ,   _   o r   . .   A l l   k e y - v a l u e   p a i r s   i n   t h e   s t r i n g D a t a   f i e l d   a r e   i n t e r n a l l y   m e r g e d   i n t o   t h e   d a t a   f i e l d .   I f   a   k e y   a p p e a r s   i n   b o t h   t h e   d a t a   a n d   t h e   s t r i n g D a t a   f i e l d ,   t h e   v a l u e   s p e c i f i e d   i n   t h e   s t r i n g D a t a   f i e l d   t a k e s   p r e c e d e n c e .


Question: What is Size limit?

Answer: I n d i v i d u a l   S e c r e t s   a r e   l i m i t e d   t o   1 M i B   i n   s i z e .   T h i s   i s   t o   d i s c o u r a g e   c r e a t i o n   o f   v e r y   l a r g e   S e c r e t s   t h a t   c o u l d   e x h a u s t   t h e   A P I   s e r v e r   a n d   k u b e l e t   m e m o r y .   H o w e v e r ,   c r e a t i o n   o f   m a n y   s m a l l e r   S e c r e t s   c o u l d   a l s o   e x h a u s t   m e m o r y .   Y o u   c a n   u s e   a   r e s o u r c e   q u o t a   t o   l i m i t   t h e   n u m b e r   o f   S e c r e t s   ( o r   o t h e r   r e s o u r c e s )   i n   a   n a m e s p a c e .


Question: What is Editing a Secret?

Answer: Y o u   c a n   e d i t   a n   e x i s t i n g   S e c r e t   u n l e s s   i t   i s   i m m u t a b l e .   T o   e d i t   a   S e c r e t ,   u s e   o n e   o f   t h e   f o l l o w i n g   m e t h o d s :   U s e   k u b e c t l U s e   a   c o n f i g u r a t i o n   f i l e   Y o u   c a n   a l s o   e d i t   t h e   d a t a   i n   a   S e c r e t   u s i n g   t h e   K u s t o m i z e   t o o l .   H o w e v e r ,   t h i s   m e t h o d   c r e a t e s   a   n e w   S e c r e t   o b j e c t   w i t h   t h e   e d i t e d   d a t a .   D e p e n d i n g   o n   h o w   y o u   c r e a t e d   t h e   S e c r e t ,   a s   w e l l   a s   h o w   t h e   S e c r e t   i s   u s e d   i n   y o u r   P o d s ,   u p d a t e s   t o   e x i s t i n g   S e c r e t   o b j e c t s   a r e   p r o p a g a t e d   a u t o m a t i c a l l y   t o   P o d s   t h a t   u s e   t h e   d a t a .   F o r   m o r e   i n f o r m a t i o n ,   r e f e r   t o   U s i n g   S e c r e t s   a s   f i l e s   f r o m   a   P o d   s e c t i o n .


Question: What is Using a Secret?

Answer: S e c r e t s   c a n   b e   m o u n t e d   a s   d a t a   v o l u m e s   o r   e x p o s e d   a s   e n v i r o n m e n t   v a r i a b l e s   t o   b e   u s e d   b y   a   c o n t a i n e r   i n   a   P o d .   S e c r e t s   c a n   a l s o   b e   u s e d   b y   o t h e r   p a r t s   o f   t h e   s y s t e m ,   w i t h o u t   b e i n g   d i r e c t l y   e x p o s e d   t o   t h e   P o d .   F o r   e x a m p l e ,   S e c r e t s   c a n   h o l d   c r e d e n t i a l s   t h a t   o t h e r   p a r t s   o f   t h e   s y s t e m   s h o u l d   u s e   t o   i n t e r a c t   w i t h   e x t e r n a l   s y s t e m s   o n   y o u r   b e h a l f .   S e c r e t   v o l u m e   s o u r c e s   a r e   v a l i d a t e d   t o   e n s u r e   t h a t   t h e   s p e c i f i e d   o b j e c t   r e f e r e n c e   a c t u a l l y   p o i n t s   t o   a n   o b j e c t   o f   t y p e   S e c r e t .   T h e r e f o r e ,   a   S e c r e t   n e e d s   t o   b e   c r e a t e d   b e f o r e   a n y   P o d s   t h a t   d e p e n d   o n   i t .   I f   t h e   S e c r e t   c a n n o t   b e   f e t c h e d   ( p e r h a p s   b e c a u s e   i t   d o e s   n o t   e x i s t ,   o r   d u e   t o   a   t e m p o r a r y   l a c k   o f   c o n n e c t i o n   t o   t h e   A P I   s e r v e r )   t h e   k u b e l e t   p e r i o d i c a l l y   r e t r i e s   r u n n i n g   t h a t   P o d .   T h e   k u b e l e t   a l s o   r e p o r t s   a n   E v e n t   f o r   t h a t   P o d ,   i n c l u d i n g   d e t a i l s   o f   t h e   p r o b l e m   f e t c h i n g   t h e   S e c r e t .


Question: What is Optional Secrets?

Answer: W h e n   y o u   r e f e r e n c e   a   S e c r e t   i n   a   P o d ,   y o u   c a n   m a r k   t h e   S e c r e t   a s   o p t i o n a l ,   s u c h   a s   i n   t h e   f o l l o w i n g   e x a m p l e .   I f   a n   o p t i o n a l   S e c r e t   d o e s n ' t   e x i s t ,   K u b e r n e t e s   i g n o r e s   i t .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   m y p o d   s p e c :   c o n t a i n e r s :   -   n a m e :   m y p o d   i m a g e :   r e d i s   v o l u m e M o u n t s :   -   n a m e :   f o o   m o u n t P a t h :   " / e t c / f o o "   r e a d O n l y :   t r u e   v o l u m e s :   -   n a m e :   f o o   s e c r e t :   s e c r e t N a m e :   m y s e c r e t   o p t i o n a l :   t r u e   B y   d e f a u l t ,   S e c r e t s   a r e   r e q u i r e d .   N o n e   o f   a   P o d ' s   c o n t a i n e r s   w i l l   s t a r t   u n t i l   a l l   n o n - o p t i o n a l   S e c r e t s   a r e   a v a i l a b l e .   I f   a   P o d   r e f e r e n c e s   a   s p e c i f i c   k e y   i n   a   n o n - o p t i o n a l   S e c r e t   a n d   t h a t   S e c r e t   d o e s   e x i s t ,   b u t   i s   m i s s i n g   t h e   n a m e d   k e y ,   t h e   P o d   f a i l s   d u r i n g   s t a r t u p .


Question: What is Using Secrets as files from a Pod?

Answer: I f   y o u   w a n t   t o   a c c e s s   d a t a   f r o m   a   S e c r e t   i n   a   P o d ,   o n e   w a y   t o   d o   t h a t   i s   t o   h a v e   K u b e r n e t e s   m a k e   t h e   v a l u e   o f   t h a t   S e c r e t   b e   a v a i l a b l e   a s   a   f i l e   i n s i d e   t h e   f i l e s y s t e m   o f   o n e   o r   m o r e   o f   t h e   P o d ' s   c o n t a i n e r s .   F o r   i n s t r u c t i o n s ,   r e f e r   t o   C r e a t e   a   P o d   t h a t   h a s   a c c e s s   t o   t h e   s e c r e t   d a t a   t h r o u g h   a   V o l u m e .   W h e n   a   v o l u m e   c o n t a i n s   d a t a   f r o m   a   S e c r e t ,   a n d   t h a t   S e c r e t   i s   u p d a t e d ,   K u b e r n e t e s   t r a c k s   t h i s   a n d   u p d a t e s   t h e   d a t a   i n   t h e   v o l u m e ,   u s i n g   a n   e v e n t u a l l y - c o n s i s t e n t   a p p r o a c h .


Question: What is Note:?

Answer: T h e   k u b e l e t   k e e p s   a   c a c h e   o f   t h e   c u r r e n t   k e y s   a n d   v a l u e s   f o r   t h e   S e c r e t s   t h a t   a r e   u s e d   i n   v o l u m e s   f o r   p o d s   o n   t h a t   n o d e .   Y o u   c a n   c o n f i g u r e   t h e   w a y   t h a t   t h e   k u b e l e t   d e t e c t s   c h a n g e s   f r o m   t h e   c a c h e d   v a l u e s .   T h e   c o n f i g M a p A n d S e c r e t C h a n g e D e t e c t i o n S t r a t e g y   f i e l d   i n   t h e   k u b e l e t   c o n f i g u r a t i o n   c o n t r o l s   w h i c h   s t r a t e g y   t h e   k u b e l e t   u s e s .   T h e   d e f a u l t   s t r a t e g y   i s   W a t c h .   U p d a t e s   t o   S e c r e t s   c a n   b e   e i t h e r   p r o p a g a t e d   b y   a n   A P I   w a t c h   m e c h a n i s m   ( t h e   d e f a u l t ) ,   b a s e d   o n   a   c a c h e   w i t h   a   d e f i n e d   t i m e - t o - l i v e ,   o r   p o l l e d   f r o m   t h e   c l u s t e r   A P I   s e r v e r   o n   e a c h   k u b e l e t   s y n c h r o n i s a t i o n   l o o p .   A s   a   r e s u l t ,   t h e   t o t a l   d e l a y   f r o m   t h e   m o m e n t   w h e n   t h e   S e c r e t   i s   u p d a t e d   t o   t h e   m o m e n t   w h e n   n e w   k e y s   a r e   p r o j e c t e d   t o   t h e   P o d   c a n   b e   a s   l o n g   a s   t h e   k u b e l e t   s y n c   p e r i o d   +   c a c h e   p r o p a g a t i o n   d e l a y ,   w h e r e   t h e   c a c h e   p r o p a g a t i o n   d e l a y   d e p e n d s   o n   t h e   c h o s e n   c a c h e   t y p e   ( f o l l o w i n g   t h e   s a m e   o r d e r   l i s t e d   i n   t h e   p r e v i o u s   p a r a g r a p h ,   t h e s e   a r e :   w a t c h   p r o p a g a t i o n   d e l a y ,   t h e   c o n f i g u r e d   c a c h e   T T L ,   o r   z e r o   f o r   d i r e c t   p o l l i n g ) .


Question: What is Using Secrets as environment variables?

Answer: T o   u s e   a   S e c r e t   i n   a n   e n v i r o n m e n t   v a r i a b l e   i n   a   P o d :   F o r   e a c h   c o n t a i n e r   i n   y o u r   P o d   s p e c i f i c a t i o n ,   a d d   a n   e n v i r o n m e n t   v a r i a b l e   f o r   e a c h   S e c r e t   k e y   t h a t   y o u   w a n t   t o   u s e   t o   t h e   e n v [ ] . v a l u e F r o m . s e c r e t K e y R e f   f i e l d . M o d i f y   y o u r   i m a g e   a n d / o r   c o m m a n d   l i n e   s o   t h a t   t h e   p r o g r a m   l o o k s   f o r   v a l u e s   i n   t h e   s p e c i f i e d   e n v i r o n m e n t   v a r i a b l e s .   F o r   i n s t r u c t i o n s ,   r e f e r   t o   D e f i n e   c o n t a i n e r   e n v i r o n m e n t   v a r i a b l e s   u s i n g   S e c r e t   d a t a .   I t ' s   i m p o r t a n t   t o   n o t e   t h a t   t h e   r a n g e   o f   c h a r a c t e r s   a l l o w e d   f o r   e n v i r o n m e n t   v a r i a b l e   n a m e s   i n   p o d s   i s   r e s t r i c t e d .   I f   a n y   k e y s   d o   n o t   m e e t   t h e   r u l e s ,   t h o s e   k e y s   a r e   n o t   m a d e   a v a i l a b l e   t o   y o u r   c o n t a i n e r ,   t h o u g h   t h e   P o d   i s   a l l o w e d   t o   s t a r t .


Question: What is Container image pull Secrets?

Answer: I f   y o u   w a n t   t o   f e t c h   c o n t a i n e r   i m a g e s   f r o m   a   p r i v a t e   r e p o s i t o r y ,   y o u   n e e d   a   w a y   f o r   t h e   k u b e l e t   o n   e a c h   n o d e   t o   a u t h e n t i c a t e   t o   t h a t   r e p o s i t o r y .   Y o u   c a n   c o n f i g u r e   i m a g e   p u l l   S e c r e t s   t o   m a k e   t h i s   p o s s i b l e .   T h e s e   S e c r e t s   a r e   c o n f i g u r e d   a t   t h e   P o d   l e v e l .


Question: What is Using imagePullSecrets?

Answer: T h e   i m a g e P u l l S e c r e t s   f i e l d   i s   a   l i s t   o f   r e f e r e n c e s   t o   S e c r e t s   i n   t h e   s a m e   n a m e s p a c e .   Y o u   c a n   u s e   a n   i m a g e P u l l S e c r e t s   t o   p a s s   a   S e c r e t   t h a t   c o n t a i n s   a   D o c k e r   ( o r   o t h e r )   i m a g e   r e g i s t r y   p a s s w o r d   t o   t h e   k u b e l e t .   T h e   k u b e l e t   u s e s   t h i s   i n f o r m a t i o n   t o   p u l l   a   p r i v a t e   i m a g e   o n   b e h a l f   o f   y o u r   P o d .   S e e   t h e   P o d S p e c   A P I   f o r   m o r e   i n f o r m a t i o n   a b o u t   t h e   i m a g e P u l l S e c r e t s   f i e l d .


Question: What is Manually specifying an imagePullSecret?

Answer: Y o u   c a n   l e a r n   h o w   t o   s p e c i f y   i m a g e P u l l S e c r e t s   f r o m   t h e   c o n t a i n e r   i m a g e s   d o c u m e n t a t i o n .


Question: What is Arranging for imagePullSecrets to be automatically attached?

Answer: Y o u   c a n   m a n u a l l y   c r e a t e   i m a g e P u l l S e c r e t s ,   a n d   r e f e r e n c e   t h e s e   f r o m   a   S e r v i c e A c c o u n t .   A n y   P o d s   c r e a t e d   w i t h   t h a t   S e r v i c e A c c o u n t   o r   c r e a t e d   w i t h   t h a t   S e r v i c e A c c o u n t   b y   d e f a u l t ,   w i l l   g e t   t h e i r   i m a g e P u l l S e c r e t s   f i e l d   s e t   t o   t h a t   o f   t h e   s e r v i c e   a c c o u n t .   S e e   A d d   I m a g e P u l l S e c r e t s   t o   a   s e r v i c e   a c c o u n t   f o r   a   d e t a i l e d   e x p l a n a t i o n   o f   t h a t   p r o c e s s .


Question: What is Using Secrets with static Pods?

Answer: Y o u   c a n n o t   u s e   C o n f i g M a p s   o r   S e c r e t s   w i t h   s t a t i c   P o d s .


Question: What is Immutable Secrets?

Answer: K u b e r n e t e s   l e t s   y o u   m a r k   s p e c i f i c   S e c r e t s   ( a n d   C o n f i g M a p s )   a s   i m m u t a b l e .   P r e v e n t i n g   c h a n g e s   t o   t h e   d a t a   o f   a n   e x i s t i n g   S e c r e t   h a s   t h e   f o l l o w i n g   b e n e f i t s :   p r o t e c t s   y o u   f r o m   a c c i d e n t a l   ( o r   u n w a n t e d )   u p d a t e s   t h a t   c o u l d   c a u s e   a p p l i c a t i o n s   o u t a g e s ( f o r   c l u s t e r s   t h a t   e x t e n s i v e l y   u s e   S e c r e t s   -   a t   l e a s t   t e n s   o f   t h o u s a n d s   o f   u n i q u e   S e c r e t   t o   P o d   m o u n t s ) ,   s w i t c h i n g   t o   i m m u t a b l e   S e c r e t s   i m p r o v e s   t h e   p e r f o r m a n c e   o f   y o u r   c l u s t e r   b y   s i g n i f i c a n t l y   r e d u c i n g   l o a d   o n   k u b e - a p i s e r v e r .   T h e   k u b e l e t   d o e s   n o t   n e e d   t o   m a i n t a i n   a   [ w a t c h ]   o n   a n y   S e c r e t s   t h a t   a r e   m a r k e d   a s   i m m u t a b l e .


Question: What is Marking a Secret as immutable?

Answer: Y o u   c a n   c r e a t e   a n   i m m u t a b l e   S e c r e t   b y   s e t t i n g   t h e   i m m u t a b l e   f i e l d   t o   t r u e .   F o r   e x a m p l e ,   a p i V e r s i o n :   v 1   k i n d :   S e c r e t   m e t a d a t a :   . . .   d a t a :   . . .   i m m u t a b l e :   t r u e   Y o u   c a n   a l s o   u p d a t e   a n y   e x i s t i n g   m u t a b l e   S e c r e t   t o   m a k e   i t   i m m u t a b l e .


Question: What is Information security for Secrets?

Answer: A l t h o u g h   C o n f i g M a p   a n d   S e c r e t   w o r k   s i m i l a r l y ,   K u b e r n e t e s   a p p l i e s   s o m e   a d d i t i o n a l   p r o t e c t i o n   f o r   S e c r e t   o b j e c t s .   S e c r e t s   o f t e n   h o l d   v a l u e s   t h a t   s p a n   a   s p e c t r u m   o f   i m p o r t a n c e ,   m a n y   o f   w h i c h   c a n   c a u s e   e s c a l a t i o n s   w i t h i n   K u b e r n e t e s   ( e . g .   s e r v i c e   a c c o u n t   t o k e n s )   a n d   t o   e x t e r n a l   s y s t e m s .   E v e n   i f   a n   i n d i v i d u a l   a p p   c a n   r e a s o n   a b o u t   t h e   p o w e r   o f   t h e   S e c r e t s   i t   e x p e c t s   t o   i n t e r a c t   w i t h ,   o t h e r   a p p s   w i t h i n   t h e   s a m e   n a m e s p a c e   c a n   r e n d e r   t h o s e   a s s u m p t i o n s   i n v a l i d .   A   S e c r e t   i s   o n l y   s e n t   t o   a   n o d e   i f   a   P o d   o n   t h a t   n o d e   r e q u i r e s   i t .   F o r   m o u n t i n g   S e c r e t s   i n t o   P o d s ,   t h e   k u b e l e t   s t o r e s   a   c o p y   o f   t h e   d a t a   i n t o   a   t m p f s   s o   t h a t   t h e   c o n f i d e n t i a l   d a t a   i s   n o t   w r i t t e n   t o   d u r a b l e   s t o r a g e .   O n c e   t h e   P o d   t h a t   d e p e n d s   o n   t h e   S e c r e t   i s   d e l e t e d ,   t h e   k u b e l e t   d e l e t e s   i t s   l o c a l   c o p y   o f   t h e   c o n f i d e n t i a l   d a t a   f r o m   t h e   S e c r e t .   T h e r e   m a y   b e   s e v e r a l   c o n t a i n e r s   i n   a   P o d .   B y   d e f a u l t ,   c o n t a i n e r s   y o u   d e f i n e   o n l y   h a v e   a c c e s s   t o   t h e   d e f a u l t   S e r v i c e A c c o u n t   a n d   i t s   r e l a t e d   S e c r e t .   Y o u   m u s t   e x p l i c i t l y   d e f i n e   e n v i r o n m e n t   v a r i a b l e s   o r   m a


Question: What is Configure least-privilege access to Secrets?

Answer: T o   e n h a n c e   t h e   s e c u r i t y   m e a s u r e s   a r o u n d   S e c r e t s ,   u s e   s e p a r a t e   n a m e s p a c e s   t o   i s o l a t e   a c c e s s   t o   m o u n t e d   s e c r e t s .


Question: What is What's next?

Answer: F o r   g u i d e l i n e s   t o   m a n a g e   a n d   i m p r o v e   t h e   s e c u r i t y   o f   y o u r   S e c r e t s ,   r e f e r   t o   G o o d   p r a c t i c e s   f o r   K u b e r n e t e s   S e c r e t s . L e a r n   h o w   t o   m a n a g e   S e c r e t s   u s i n g   k u b e c t l L e a r n   h o w   t o   m a n a g e   S e c r e t s   u s i n g   c o n f i g   f i l e L e a r n   h o w   t o   m a n a g e   S e c r e t s   u s i n g   k u s t o m i z e R e a d   t h e   A P I   r e f e r e n c e   f o r   S e c r e t


Question: What is Virtual IPs and Service Proxies?

Answer: Virtual IPs and Service ProxiesEvery node in a Kubernetes cluster runs a kube-proxy (unless you have deployed your own alternative component in place of kube-proxy).The kube-proxy component is responsible for implementing a virtual IP mechanism for Services of type other than ExternalName. Each instance of kube-proxy watches the Kubernetes control plane for the addition and removal of Service and EndpointSlice objects. For each Service, kube-proxy calls appropriate APIs (depending on the kube-proxy mode) to configure the node to capture traffic to the Service's clusterIP and port, and redirect that traffic to one of the Service's endpoints (usually a Pod, but possibly an arbitrary user-provided IP address). A control loop ensures that the rules on each node are reliably synchronized with the Service and EndpointSlice state as indicated by the API server.Virtual IP mechanism for Services, using iptables modeA question that pops up every now and then is why Kubernetes relies on proxying to forward inbound traffic to backends. What about other approaches? For example, would it be possible to configure DNS records that have multiple A values (or AAAA for IPv6), and rely on round-robin name resolution?There are a few reasons for using proxying for Services:There is a long history of DNS implementations not respecting record TTLs, and caching the results of name lookups after they should have expired.Some apps do DNS lookups only once and cache the results indefinitely.Even if apps and libraries did proper re-resolution, the low or zero TTLs on the DNS records could impose a high load on DNS that then becomes difficult to manage.Later in this page you can read about how various kube-proxy implementations work. Overall, you should note that, when running kube-proxy, kernel level rules may be modified (for example, iptables rules might get created), which won't get cleaned up, in some cases until you reboot. Thus, running kube-proxy is something that should only be done by an administrator who understands the consequences of having a low level, privileged network proxying service on a computer. Although the kube-proxy executable supports a cleanup function, this function is not an official feature and thus is only available to use as-is.Some of the details in this reference refer to an example: the backend Pods for a stateless image-processing workloads, running with three replicas. Those replicas are fungible—frontends do not care which backend they use. While the actual Pods that compose the backend set may change, the frontend clients should not need to be aware of that, nor should they need to keep track of the set of backends themselves.Proxy modesThe kube-proxy starts up in different modes, which are determined by its configuration.On Linux nodes, the available modes for kube-proxy are:iptablesA mode where the kube-proxy configures packet forwarding rules using iptables.ipvsa mode where the kube-proxy configures packet forwarding rules using ipvs.n


Question: How does Virtual IPs and Service Proxies work?

Answer: Virtual IPs and Service ProxiesEvery node in a Kubernetes cluster runs a kube-proxy (unless you have deployed your own alternative component in place of kube-proxy).The kube-proxy component is responsible for implementing a virtual IP mechanism for Services of type other than ExternalName. Each instance of kube-proxy watches the Kubernetes control plane for the addition and removal of Service and EndpointSlice objects. For each Service, kube-proxy calls appropriate APIs (depending on the kube-proxy mode) to configure the node to capture traffic to the Service's clusterIP and port, and redirect that traffic to one of the Service's endpoints (usually a Pod, but possibly an arbitrary user-provided IP address). A control loop ensures that the rules on each node are reliably synchronized with the Service and EndpointSlice state as indicated by the API server.Virtual IP mechanism for Services, using iptables modeA question that pops up every now and then is why Kubernetes relies on proxying to forward inbound traffic to backends. What about other approaches? For example, would it be possible to configure DNS records that have multiple A values (or AAAA for IPv6), and rely on round-robin name resolution?There are a few reasons for using proxying for Services:There is a long history of DNS implementations not respecting record TTLs, and caching the results of name lookups after they should have expired.Some apps do DNS lookups only once and cache the results indefinitely.Even if apps and libraries did proper re-resolution, the low or zero TTLs on the DNS records could impose a high load on DNS that then becomes difficult to manage.Later in this page you can read about how various kube-proxy implementations work. Overall, you should note that, when running kube-proxy, kernel level rules may be modified (for example, iptables rules might get created), which won't get cleaned up, in some cases until you reboot. Thus, running kube-proxy is something that should only be done by an administrator who understands the consequences of having a low level, privileged network proxying service on a computer. Although the kube-proxy executable supports a cleanup function, this function is not an official feature and thus is only available to use as-is.Some of the details in this reference refer to an example: the backend Pods for a stateless image-processing workloads, running with three replicas. Those replicas are fungible—frontends do not care which backend they use. While the actual Pods that compose the backend set may change, the frontend clients should not need to be aware of that, nor should they need to keep track of the set of backends themselves.Proxy modesThe kube-proxy starts up in different modes, which are determined by its configuration.On Linux nodes, the available modes for kube-proxy are:iptablesA mode where the kube-proxy configures packet forwarding rules using iptables.ipvsa mode where the kube-proxy configures packet forwarding rules using ipvs.n


Question: When would you use Virtual IPs and Service Proxies?

Answer: Virtual IPs and Service ProxiesEvery node in a Kubernetes cluster runs a kube-proxy (unless you have deployed your own alternative component in place of kube-proxy).The kube-proxy component is responsible for implementing a virtual IP mechanism for Services of type other than ExternalName. Each instance of kube-proxy watches the Kubernetes control plane for the addition and removal of Service and EndpointSlice objects. For each Service, kube-proxy calls appropriate APIs (depending on the kube-proxy mode) to configure the node to capture traffic to the Service's clusterIP and port, and redirect that traffic to one of the Service's endpoints (usually a Pod, but possibly an arbitrary user-provided IP address). A control loop ensures that the rules on each node are reliably synchronized with the Service and EndpointSlice state as indicated by the API server.Virtual IP mechanism for Services, using iptables modeA question that pops up every now and then is why Kubernetes relies on proxying to forward inbound traffic to backends. What about other approaches? For example, would it be possible to configure DNS records that have multiple A values (or AAAA for IPv6), and rely on round-robin name resolution?There are a few reasons for using proxying for Services:There is a long history of DNS implementations not respecting record TTLs, and caching the results of name lookups after they should have expired.Some apps do DNS lookups only once and cache the results indefinitely.Even if apps and libraries did proper re-resolution, the low or zero TTLs on the DNS records could impose a high load on DNS that then becomes difficult to manage.Later in this page you can read about how various kube-proxy implementations work. Overall, you should note that, when running kube-proxy, kernel level rules may be modified (for example, iptables rules might get created), which won't get cleaned up, in some cases until you reboot. Thus, running kube-proxy is something that should only be done by an administrator who understands the consequences of having a low level, privileged network proxying service on a computer. Although the kube-proxy executable supports a cleanup function, this function is not an official feature and thus is only available to use as-is.Some of the details in this reference refer to an example: the backend Pods for a stateless image-processing workloads, running with three replicas. Those replicas are fungible—frontends do not care which backend they use. While the actual Pods that compose the backend set may change, the frontend clients should not need to be aware of that, nor should they need to keep track of the set of backends themselves.Proxy modesThe kube-proxy starts up in different modes, which are determined by its configuration.On Linux nodes, the available modes for kube-proxy are:iptablesA mode where the kube-proxy configures packet forwarding rules using iptables.ipvsa mode where the kube-proxy configures packet forwarding rules using ipvs.n


Question: What are the benefits of Virtual IPs and Service Proxies?

Answer: Virtual IPs and Service ProxiesEvery node in a Kubernetes cluster runs a kube-proxy (unless you have deployed your own alternative component in place of kube-proxy).The kube-proxy component is responsible for implementing a virtual IP mechanism for Services of type other than ExternalName. Each instance of kube-proxy watches the Kubernetes control plane for the addition and removal of Service and EndpointSlice objects. For each Service, kube-proxy calls appropriate APIs (depending on the kube-proxy mode) to configure the node to capture traffic to the Service's clusterIP and port, and redirect that traffic to one of the Service's endpoints (usually a Pod, but possibly an arbitrary user-provided IP address). A control loop ensures that the rules on each node are reliably synchronized with the Service and EndpointSlice state as indicated by the API server.Virtual IP mechanism for Services, using iptables modeA question that pops up every now and then is why Kubernetes relies on proxying to forward inbound traffic to backends. What about other approaches? For example, would it be possible to configure DNS records that have multiple A values (or AAAA for IPv6), and rely on round-robin name resolution?There are a few reasons for using proxying for Services:There is a long history of DNS implementations not respecting record TTLs, and caching the results of name lookups after they should have expired.Some apps do DNS lookups only once and cache the results indefinitely.Even if apps and libraries did proper re-resolution, the low or zero TTLs on the DNS records could impose a high load on DNS that then becomes difficult to manage.Later in this page you can read about how various kube-proxy implementations work. Overall, you should note that, when running kube-proxy, kernel level rules may be modified (for example, iptables rules might get created), which won't get cleaned up, in some cases until you reboot. Thus, running kube-proxy is something that should only be done by an administrator who understands the consequences of having a low level, privileged network proxying service on a computer. Although the kube-proxy executable supports a cleanup function, this function is not an official feature and thus is only available to use as-is.Some of the details in this reference refer to an example: the backend Pods for a stateless image-processing workloads, running with three replicas. Those replicas are fungible—frontends do not care which backend they use. While the actual Pods that compose the backend set may change, the frontend clients should not need to be aware of that, nor should they need to keep track of the set of backends themselves.Proxy modesThe kube-proxy starts up in different modes, which are determined by its configuration.On Linux nodes, the available modes for kube-proxy are:iptablesA mode where the kube-proxy configures packet forwarding rules using iptables.ipvsa mode where the kube-proxy configures packet forwarding rules using ipvs.n


Question: What is Virtual IPs and Service Proxies?

Answer: E v e r y   n o d e   i n   a   K u b e r n e t e s   c l u s t e r   r u n s   a   k u b e - p r o x y   ( u n l e s s   y o u   h a v e   d e p l o y e d   y o u r   o w n   a l t e r n a t i v e   c o m p o n e n t   i n   p l a c e   o f   k u b e - p r o x y ) .   T h e   k u b e - p r o x y   c o m p o n e n t   i s   r e s p o n s i b l e   f o r   i m p l e m e n t i n g   a   v i r t u a l   I P   m e c h a n i s m   f o r   S e r v i c e s   o f   t y p e   o t h e r   t h a n   E x t e r n a l N a m e .   E a c h   i n s t a n c e   o f   k u b e - p r o x y   w a t c h e s   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   f o r   t h e   a d d i t i o n   a n d   r e m o v a l   o f   S e r v i c e   a n d   E n d p o i n t S l i c e   o b j e c t s .   F o r   e a c h   S e r v i c e ,   k u b e - p r o x y   c a l l s   a p p r o p r i a t e   A P I s   ( d e p e n d i n g   o n   t h e   k u b e - p r o x y   m o d e )   t o   c o n f i g u r e   t h e   n o d e   t o   c a p t u r e   t r a f f i c   t o   t h e   S e r v i c e ' s   c l u s t e r I P   a n d   p o r t ,   a n d   r e d i r e c t   t h a t   t r a f f i c   t o   o n e   o f   t h e   S e r v i c e ' s   e n d p o i n t s   ( u s u a l l y   a   P o d ,   b u t   p o s s i b l y   a n   a r b i t r a r y   u s e r - p r o v i d e d   I P   a d d r e s s ) .   A   c o n t r o l   l o o p   e n s u r e s   t h a t   t h e   r u l e s   o n   e a c h   n o d e   a r e   r e l i a b l y   s y n c h r o n i z e d   w i t h   t h e   S e r v i c e   a n d   E n d p o i n t S l i c e   s t a t e   a s   i n d i c a t e d   b y   t h e   A P I   s e r v e r .


Question: What is Virtual IP mechanism for Services, using iptables mode?

Answer: A   q u e s t i o n   t h a t   p o p s   u p   e v e r y   n o w   a n d   t h e n   i s   w h y   K u b e r n e t e s   r e l i e s   o n   p r o x y i n g   t o   f o r w a r d   i n b o u n d   t r a f f i c   t o   b a c k e n d s .   W h a t   a b o u t   o t h e r   a p p r o a c h e s ?   F o r   e x a m p l e ,   w o u l d   i t   b e   p o s s i b l e   t o   c o n f i g u r e   D N S   r e c o r d s   t h a t   h a v e   m u l t i p l e   A   v a l u e s   ( o r   A A A A   f o r   I P v 6 ) ,   a n d   r e l y   o n   r o u n d - r o b i n   n a m e   r e s o l u t i o n ?   T h e r e   a r e   a   f e w   r e a s o n s   f o r   u s i n g   p r o x y i n g   f o r   S e r v i c e s :   T h e r e   i s   a   l o n g   h i s t o r y   o f   D N S   i m p l e m e n t a t i o n s   n o t   r e s p e c t i n g   r e c o r d   T T L s ,   a n d   c a c h i n g   t h e   r e s u l t s   o f   n a m e   l o o k u p s   a f t e r   t h e y   s h o u l d   h a v e   e x p i r e d . S o m e   a p p s   d o   D N S   l o o k u p s   o n l y   o n c e   a n d   c a c h e   t h e   r e s u l t s   i n d e f i n i t e l y . E v e n   i f   a p p s   a n d   l i b r a r i e s   d i d   p r o p e r   r e - r e s o l u t i o n ,   t h e   l o w   o r   z e r o   T T L s   o n   t h e   D N S   r e c o r d s   c o u l d   i m p o s e   a   h i g h   l o a d   o n   D N S   t h a t   t h e n   b e c o m e s   d i f f i c u l t   t o   m a n a g e .   L a t e r   i n   t h i s   p a g e   y o u   c a n   r e a d   a b o u t   h o w   v a r i o u s   k u b e - p r o x y   i m p l e m e n t a t i o n s   w o r k .   O v e r a l l ,   y o u   s h o u l d   n o t e   t h a t ,   w h e n   r u n n i n g   k u b e - p r o x y ,   k e r n e l   l e v e l   r u l e s   m a y   b e   m o d i f i e d   ( f o r   e x a m p l e ,   i p t a b l e s   r u l e s   m i g h t   g e t   c r e a t e d ) ,   w h i c h   w o n ' t   g e t   c l e a n e d   u p ,   i n   s o m e   c a s e s   u


Question: What is Proxy modes?

Answer: T h e   k u b e - p r o x y   s t a r t s   u p   i n   d i f f e r e n t   m o d e s ,   w h i c h   a r e   d e t e r m i n e d   b y   i t s   c o n f i g u r a t i o n .   O n   L i n u x   n o d e s ,   t h e   a v a i l a b l e   m o d e s   f o r   k u b e - p r o x y   a r e :   T h e r e   i s   o n l y   o n e   m o d e   a v a i l a b l e   f o r   k u b e - p r o x y   o n   W i n d o w s :


Question: What is iptables proxy mode?

Answer: T h i s   p r o x y   m o d e   i s   o n l y   a v a i l a b l e   o n   L i n u x   n o d e s .   I n   t h i s   m o d e ,   k u b e - p r o x y   c o n f i g u r e s   p a c k e t   f o r w a r d i n g   r u l e s   u s i n g   t h e   i p t a b l e s   A P I   o f   t h e   k e r n e l   n e t f i l t e r   s u b s y s t e m .   F o r   e a c h   e n d p o i n t ,   i t   i n s t a l l s   i p t a b l e s   r u l e s   w h i c h ,   b y   d e f a u l t ,   s e l e c t   a   b a c k e n d   P o d   a t   r a n d o m .


Question: What is Example?

Answer: A s   a n   e x a m p l e ,   c o n s i d e r   t h e   i m a g e   p r o c e s s i n g   a p p l i c a t i o n   d e s c r i b e d   e a r l i e r   i n   t h e   p a g e .   W h e n   t h e   b a c k e n d   S e r v i c e   i s   c r e a t e d ,   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   a s s i g n s   a   v i r t u a l   I P   a d d r e s s ,   f o r   e x a m p l e   1 0 . 0 . 0 . 1 .   F o r   t h i s   e x a m p l e ,   a s s u m e   t h a t   t h e   S e r v i c e   p o r t   i s   1 2 3 4 .   A l l   o f   t h e   k u b e - p r o x y   i n s t a n c e s   i n   t h e   c l u s t e r   o b s e r v e   t h e   c r e a t i o n   o f   t h e   n e w   S e r v i c e .   W h e n   k u b e - p r o x y   o n   a   n o d e   s e e s   a   n e w   S e r v i c e ,   i t   i n s t a l l s   a   s e r i e s   o f   i p t a b l e s   r u l e s   w h i c h   r e d i r e c t   f r o m   t h e   v i r t u a l   I P   a d d r e s s   t o   m o r e   i p t a b l e s   r u l e s ,   d e f i n e d   p e r   S e r v i c e .   T h e   p e r - S e r v i c e   r u l e s   l i n k   t o   f u r t h e r   r u l e s   f o r   e a c h   b a c k e n d   e n d p o i n t ,   a n d   t h e   p e r -   e n d p o i n t   r u l e s   r e d i r e c t   t r a f f i c   ( u s i n g   d e s t i n a t i o n   N A T )   t o   t h e   b a c k e n d s .   W h e n   a   c l i e n t   c o n n e c t s   t o   t h e   S e r v i c e ' s   v i r t u a l   I P   a d d r e s s   t h e   i p t a b l e s   r u l e   k i c k s   i n .   A   b a c k e n d   i s   c h o s e n   ( e i t h e r   b a s e d   o n   s e s s i o n   a f f i n i t y   o r   r a n d o m l y )   a n d   p a c k e t s   a r e   r e d i r e c t e d   t o   t h e   b a c k e n d   w i t h o u t   r e w r i t i n g   t h e   c l i e n t   I P   a d d r e s s .   T h i s   s a m e   b a s i c   f l o w   e x e c u t e s   w h e n   t r a f f i c   c o m e s   i n   t h r o u g h   a   t y p e :   N o d e P o r t   S e r v i c


Question: What is Optimizing iptables mode performance?

Answer: I n   i p t a b l e s   m o d e ,   k u b e - p r o x y   c r e a t e s   a   f e w   i p t a b l e s   r u l e s   f o r   e v e r y   S e r v i c e ,   a n d   a   f e w   i p t a b l e s   r u l e s   f o r   e a c h   e n d p o i n t   I P   a d d r e s s .   I n   c l u s t e r s   w i t h   t e n s   o f   t h o u s a n d s   o f   P o d s   a n d   S e r v i c e s ,   t h i s   m e a n s   t e n s   o f   t h o u s a n d s   o f   i p t a b l e s   r u l e s ,   a n d   k u b e - p r o x y   m a y   t a k e   a   l o n g   t i m e   t o   u p d a t e   t h e   r u l e s   i n   t h e   k e r n e l   w h e n   S e r v i c e s   ( o r   t h e i r   E n d p o i n t S l i c e s )   c h a n g e .   Y o u   c a n   a d j u s t   t h e   s y n c i n g   b e h a v i o r   o f   k u b e - p r o x y   v i a   o p t i o n s   i n   t h e   i p t a b l e s   s e c t i o n   o f   t h e   k u b e - p r o x y   c o n f i g u r a t i o n   f i l e   ( w h i c h   y o u   s p e c i f y   v i a   k u b e - p r o x y   - - c o n f i g   < p a t h > ) :   . . .   i p t a b l e s :   m i n S y n c P e r i o d :   1 s   s y n c P e r i o d :   3 0 s   . . .


Question: What is minSyncPeriod?

Answer: T h e   m i n S y n c P e r i o d   p a r a m e t e r   s e t s   t h e   m i n i m u m   d u r a t i o n   b e t w e e n   a t t e m p t s   t o   r e s y n c h r o n i z e   i p t a b l e s   r u l e s   w i t h   t h e   k e r n e l .   I f   i t   i s   0 s ,   t h e n   k u b e - p r o x y   w i l l   a l w a y s   i m m e d i a t e l y   s y n c h r o n i z e   t h e   r u l e s   e v e r y   t i m e   a n y   S e r v i c e   o r   E n d p o i n t S l i c e   c h a n g e s .   T h i s   w o r k s   f i n e   i n   v e r y   s m a l l   c l u s t e r s ,   b u t   i t   r e s u l t s   i n   a   l o t   o f   r e d u n d a n t   w o r k   w h e n   l o t s   o f   t h i n g s   c h a n g e   i n   a   s m a l l   t i m e   p e r i o d .   F o r   e x a m p l e ,   i f   y o u   h a v e   a   S e r v i c e   b a c k e d   b y   a   D e p l o y m e n t   w i t h   1 0 0   p o d s ,   a n d   y o u   d e l e t e   t h e   D e p l o y m e n t ,   t h e n   w i t h   m i n S y n c P e r i o d :   0 s ,   k u b e - p r o x y   w o u l d   e n d   u p   r e m o v i n g   t h e   S e r v i c e ' s   e n d p o i n t s   f r o m   t h e   i p t a b l e s   r u l e s   o n e   b y   o n e ,   r e s u l t i n g   i n   a   t o t a l   o f   1 0 0   u p d a t e s .   W i t h   a   l a r g e r   m i n S y n c P e r i o d ,   m u l t i p l e   P o d   d e l e t i o n   e v e n t s   w o u l d   g e t   a g g r e g a t e d   t o g e t h e r ,   s o   k u b e - p r o x y   m i g h t   i n s t e a d   e n d   u p   m a k i n g ,   s a y ,   5   u p d a t e s ,   e a c h   r e m o v i n g   2 0   e n d p o i n t s ,   w h i c h   w i l l   b e   m u c h   m o r e   e f f i c i e n t   i n   t e r m s   o f   C P U ,   a n d   r e s u l t   i n   t h e   f u l l   s e t   o f   c h a n g e s   b e i n g   s y n c h r o n i z e d   f a s t e r .   T h e   l a r g e r   t h e   v a l u e   o f   m i n S y n c P e r i o d ,   t h e   m o r e   w o r k   t h a t   c a n   b e   a g g


Question: What is Updating legacy minSyncPeriod configuration?

Answer: O l d e r   v e r s i o n s   o f   k u b e - p r o x y   u p d a t e d   a l l   t h e   r u l e s   f o r   a l l   S e r v i c e s   o n   e v e r y   s y n c ;   t h i s   l e d   t o   p e r f o r m a n c e   i s s u e s   ( u p d a t e   l a g )   i n   l a r g e   c l u s t e r s ,   a n d   t h e   r e c o m m e n d e d   s o l u t i o n   w a s   t o   s e t   a   l a r g e r   m i n S y n c P e r i o d .   S i n c e   K u b e r n e t e s   v 1 . 2 8 ,   t h e   i p t a b l e s   m o d e   o f   k u b e - p r o x y   u s e s   a   m o r e   m i n i m a l   a p p r o a c h ,   o n l y   m a k i n g   u p d a t e s   w h e r e   S e r v i c e s   o r   E n d p o i n t S l i c e s   h a v e   a c t u a l l y   c h a n g e d .   I f   y o u   w e r e   p r e v i o u s l y   o v e r r i d i n g   m i n S y n c P e r i o d ,   y o u   s h o u l d   t r y   r e m o v i n g   t h a t   o v e r r i d e   a n d   l e t t i n g   k u b e - p r o x y   u s e   t h e   d e f a u l t   v a l u e   ( 1 s )   o r   a t   l e a s t   a   s m a l l e r   v a l u e   t h a n   y o u   w e r e   u s i n g   b e f o r e   u p g r a d i n g .   I f   y o u   a r e   n o t   r u n n i n g   k u b e - p r o x y   f r o m   K u b e r n e t e s   1 . 3 4 ,   c h e c k   t h e   b e h a v i o r   a n d   a s s o c i a t e d   a d v i c e   f o r   t h e   v e r s i o n   t h a t   y o u   a r e   a c t u a l l y   r u n n i n g .


Question: What is syncPeriod?

Answer: T h e   s y n c P e r i o d   p a r a m e t e r   c o n t r o l s   a   h a n d f u l   o f   s y n c h r o n i z a t i o n   o p e r a t i o n s   t h a t   a r e   n o t   d i r e c t l y   r e l a t e d   t o   c h a n g e s   i n   i n d i v i d u a l   S e r v i c e s   a n d   E n d p o i n t S l i c e s .   I n   p a r t i c u l a r ,   i t   c o n t r o l s   h o w   q u i c k l y   k u b e - p r o x y   n o t i c e s   i f   a n   e x t e r n a l   c o m p o n e n t   h a s   i n t e r f e r e d   w i t h   k u b e - p r o x y ' s   i p t a b l e s   r u l e s .   I n   l a r g e   c l u s t e r s ,   k u b e - p r o x y   a l s o   o n l y   p e r f o r m s   c e r t a i n   c l e a n u p   o p e r a t i o n s   o n c e   e v e r y   s y n c P e r i o d   t o   a v o i d   u n n e c e s s a r y   w o r k .   F o r   t h e   m o s t   p a r t ,   i n c r e a s i n g   s y n c P e r i o d   i s   n o t   e x p e c t e d   t o   h a v e   m u c h   i m p a c t   o n   p e r f o r m a n c e ,   b u t   i n   t h e   p a s t ,   i t   w a s   s o m e t i m e s   u s e f u l   t o   s e t   i t   t o   a   v e r y   l a r g e   v a l u e   ( e g ,   1 h ) .   T h i s   i s   n o   l o n g e r   r e c o m m e n d e d ,   a n d   i s   l i k e l y   t o   h u r t   f u n c t i o n a l i t y   m o r e   t h a n   i t   i m p r o v e s   p e r f o r m a n c e .


Question: What is IPVS proxy mode?

Answer: T h i s   p r o x y   m o d e   i s   o n l y   a v a i l a b l e   o n   L i n u x   n o d e s .   I n   i p v s   m o d e ,   k u b e - p r o x y   u s e s   t h e   k e r n e l   I P V S   a n d   i p t a b l e s   A P I s   t o   c r e a t e   r u l e s   t o   r e d i r e c t   t r a f f i c   f r o m   S e r v i c e   I P s   t o   e n d p o i n t   I P s .   T h e   I P V S   p r o x y   m o d e   i s   b a s e d   o n   n e t f i l t e r   h o o k   f u n c t i o n   t h a t   i s   s i m i l a r   t o   i p t a b l e s   m o d e ,   b u t   u s e s   a   h a s h   t a b l e   a s   t h e   u n d e r l y i n g   d a t a   s t r u c t u r e   a n d   w o r k s   i n   t h e   k e r n e l   s p a c e .


Question: What is Note:?

Answer: T h e   i p v s   p r o x y   m o d e   w a s   a n   e x p e r i m e n t   i n   p r o v i d i n g   a   L i n u x   k u b e - p r o x y   b a c k e n d   w i t h   b e t t e r   r u l e - s y n c h r o n i z i n g   p e r f o r m a n c e   a n d   h i g h e r   n e t w o r k - t r a f f i c   t h r o u g h p u t   t h a n   t h e   i p t a b l e s   m o d e .   W h i l e   i t   s u c c e e d e d   i n   t h o s e   g o a l s ,   t h e   k e r n e l   I P V S   A P I   t u r n e d   o u t   t o   b e   a   b a d   m a t c h   f o r   t h e   K u b e r n e t e s   S e r v i c e s   A P I ,   a n d   t h e   i p v s   b a c k e n d   w a s   n e v e r   a b l e   t o   i m p l e m e n t   a l l   o f   t h e   e d g e   c a s e s   o f   K u b e r n e t e s   S e r v i c e   f u n c t i o n a l i t y   c o r r e c t l y .   A t   s o m e   p o i n t   i n   t h e   f u t u r e ,   i t   i s   e x p e c t e d   t o   b e   f o r m a l l y   d e p r e c a t e d   a s   a   f e a t u r e .   T h e   n f t a b l e s   p r o x y   m o d e   ( d e s c r i b e d   b e l o w )   i s   e s s e n t i a l l y   a   r e p l a c e m e n t   f o r   b o t h   t h e   i p t a b l e s   a n d   i p v s   m o d e s ,   w i t h   b e t t e r   p e r f o r m a n c e   t h a n   e i t h e r   o f   t h e m ,   a n d   i s   r e c o m m e n d e d   a s   a   r e p l a c e m e n t   f o r   i p v s .   I f   y o u   a r e   d e p l o y i n g   o n t o   L i n u x   s y s t e m s   t h a t   a r e   t o o   o l d   t o   r u n   t h e   n f t a b l e s   p r o x y   m o d e ,   y o u   s h o u l d   a l s o   c o n s i d e r   t r y i n g   t h e   i p t a b l e s   m o d e   r a t h e r   t h a n   i p v s ,   s i n c e   t h e   p e r f o r m a n c e   o f   i p t a b l e s   m o d e   h a s   i m p r o v e d   g r e a t l y   s i n c e   t h e   i p v s   m o d e   w a s   f i r s t   i n t r o d u c e d .   I P V S   p r o v i d e s   m o r e   o p t i o n s   f o r   b a l a n c i n


Question: What is Note:?

Answer: T o   r u n   k u b e - p r o x y   i n   I P V S   m o d e ,   y o u   m u s t   m a k e   I P V S   a v a i l a b l e   o n   t h e   n o d e   b e f o r e   s t a r t i n g   k u b e - p r o x y .   W h e n   k u b e - p r o x y   s t a r t s   i n   I P V S   p r o x y   m o d e ,   i t   v e r i f i e s   w h e t h e r   I P V S   k e r n e l   m o d u l e s   a r e   a v a i l a b l e .   I f   t h e   I P V S   k e r n e l   m o d u l e s   a r e   n o t   d e t e c t e d ,   t h e n   k u b e - p r o x y   e x i t s   w i t h   a n   e r r o r .


Question: What is nftables proxy mode?

Answer: T h i s   p r o x y   m o d e   i s   o n l y   a v a i l a b l e   o n   L i n u x   n o d e s ,   a n d   r e q u i r e s   k e r n e l   5 . 1 3   o r   l a t e r .   I n   t h i s   m o d e ,   k u b e - p r o x y   c o n f i g u r e s   p a c k e t   f o r w a r d i n g   r u l e s   u s i n g   t h e   n f t a b l e s   A P I   o f   t h e   k e r n e l   n e t f i l t e r   s u b s y s t e m .   F o r   e a c h   e n d p o i n t ,   i t   i n s t a l l s   n f t a b l e s   r u l e s   w h i c h ,   b y   d e f a u l t ,   s e l e c t   a   b a c k e n d   P o d   a t   r a n d o m .   T h e   n f t a b l e s   A P I   i s   t h e   s u c c e s s o r   t o   t h e   i p t a b l e s   A P I   a n d   i s   d e s i g n e d   t o   p r o v i d e   b e t t e r   p e r f o r m a n c e   a n d   s c a l a b i l i t y   t h a n   i p t a b l e s .   T h e   n f t a b l e s   p r o x y   m o d e   i s   a b l e   t o   p r o c e s s   c h a n g e s   t o   s e r v i c e   e n d p o i n t s   f a s t e r   a n d   m o r e   e f f i c i e n t l y   t h a n   t h e   i p t a b l e s   m o d e ,   a n d   i s   a l s o   a b l e   t o   m o r e   e f f i c i e n t l y   p r o c e s s   p a c k e t s   i n   t h e   k e r n e l   ( t h o u g h   t h i s   o n l y   b e c o m e s   n o t i c e a b l e   i n   c l u s t e r s   w i t h   t e n s   o f   t h o u s a n d s   o f   s e r v i c e s ) .   A s   o f   K u b e r n e t e s   1 . 3 4 ,   t h e   n f t a b l e s   m o d e   i s   s t i l l   r e l a t i v e l y   n e w ,   a n d   m a y   n o t   b e   c o m p a t i b l e   w i t h   a l l   n e t w o r k   p l u g i n s ;   c o n s u l t   t h e   d o c u m e n t a t i o n   f o r   y o u r   n e t w o r k   p l u g i n .


Question: What is Migrating from iptables mode to nftables?

Answer: U s e r s   w h o   w a n t   t o   s w i t c h   f r o m   t h e   d e f a u l t   i p t a b l e s   m o d e   t o   t h e   n f t a b l e s   m o d e   s h o u l d   b e   a w a r e   t h a t   s o m e   f e a t u r e s   w o r k   s l i g h t l y   d i f f e r e n t l y   t h e   n f t a b l e s   m o d e :   N o d e P o r t   i n t e r f a c e s :   I n   i p t a b l e s   m o d e ,   b y   d e f a u l t ,   N o d e P o r t   s e r v i c e s   a r e   r e a c h a b l e   o n   a l l   l o c a l   I P   a d d r e s s e s .   T h i s   i s   u s u a l l y   n o t   w h a t   u s e r s   w a n t ,   s o   t h e   n f t a b l e s   m o d e   d e f a u l t s   t o   - - n o d e p o r t - a d d r e s s e s   p r i m a r y ,   m e a n i n g   S e r v i c e s   u s i n g   t y p e :   N o d e P o r t   a r e   o n l y   r e a c h a b l e   o n   t h e   n o d e ' s   p r i m a r y   I P v 4   a n d / o r   I P v 6   a d d r e s s e s .   Y o u   c a n   o v e r r i d e   t h i s   b y   s p e c i f y i n g   a n   e x p l i c i t   v a l u e   f o r   t h a t   o p t i o n :   e . g . ,   - - n o d e p o r t - a d d r e s s e s   0 . 0 . 0 . 0 / 0   t o   l i s t e n   o n   a l l   ( l o c a l )   I P v 4   I P s . t y p e :   N o d e P o r t   S e r v i c e s   o n   1 2 7 . 0 . 0 . 1 :   I n   i p t a b l e s   m o d e ,   i f   t h e   - - n o d e p o r t - a d d r e s s e s   r a n g e   i n c l u d e s   1 2 7 . 0 . 0 . 1   ( a n d   t h e   o p t i o n   - - i p t a b l e s - l o c a l h o s t - n o d e p o r t s   f a l s e   o p t i o n   i s   n o t   p a s s e d ) ,   t h e n   S e r v i c e s   o f   t y p e :   N o d e P o r t   a r e   r e a c h a b l e   e v e n   o n   " l o c a l h o s t "   ( 1 2 7 . 0 . 0 . 1 ) .   I n   n f t a b l e s   m o d e   ( a n d   i p v s   m o d e ) ,   t h i s   w i l l   n o t   w o r k .   I f   y o u   a r e   n o t   s u r e   i f   y o u   a r e   d e p e n d i n g   o n   t h i s   f u n c t i o n a l i t y ,   y o


Question: What is kernelspace proxy mode?

Answer: T h i s   p r o x y   m o d e   i s   o n l y   a v a i l a b l e   o n   W i n d o w s   n o d e s .   T h e   k u b e - p r o x y   c o n f i g u r e s   p a c k e t   f i l t e r i n g   r u l e s   i n   t h e   W i n d o w s   V i r t u a l   F i l t e r i n g   P l a t f o r m   ( V F P ) ,   a n   e x t e n s i o n   t o   W i n d o w s   v S w i t c h .   T h e s e   r u l e s   p r o c e s s   e n c a p s u l a t e d   p a c k e t s   w i t h i n   t h e   n o d e - l e v e l   v i r t u a l   n e t w o r k s ,   a n d   r e w r i t e   p a c k e t s   s o   t h a t   t h e   d e s t i n a t i o n   I P   a d d r e s s   ( a n d   l a y e r   2   i n f o r m a t i o n )   i s   c o r r e c t   f o r   g e t t i n g   t h e   p a c k e t   r o u t e d   t o   t h e   c o r r e c t   d e s t i n a t i o n .   T h e   W i n d o w s   V F P   i s   a n a l o g o u s   t o   t o o l s   s u c h   a s   L i n u x   n f t a b l e s   o r   i p t a b l e s .   T h e   W i n d o w s   V F P   e x t e n d s   t h e   H y p e r - V   S w i t c h ,   w h i c h   w a s   i n i t i a l l y   i m p l e m e n t e d   t o   s u p p o r t   v i r t u a l   m a c h i n e   n e t w o r k i n g .   W h e n   a   P o d   o n   a   n o d e   s e n d s   t r a f f i c   t o   a   v i r t u a l   I P   a d d r e s s ,   a n d   t h e   k u b e - p r o x y   s e l e c t s   a   P o d   o n   a   d i f f e r e n t   n o d e   a s   t h e   l o a d   b a l a n c i n g   t a r g e t ,   t h e   k e r n e l s p a c e   p r o x y   m o d e   r e w r i t e s   t h a t   p a c k e t   t o   b e   d e s t i n e d   t o   t h e   t a r g e t   b a c k e n d   P o d .   T h e   W i n d o w s   H o s t   N e t w o r k i n g   S e r v i c e   ( H N S )   e n s u r e s   t h a t   p a c k e t   r e w r i t i n g   r u l e s   a r e   c o n f i g u r e d   s o   t h a t   t h e   r e t u r n   t r a f f i c   a p p e a r s   t o   c o m e   f r o m   t h e   v i r t u a l   I P   a d d r e s s


Question: What is Direct server return for kernelspace mode?

Answer: A s   a n   a l t e r n a t i v e   t o   t h e   b a s i c   o p e r a t i o n ,   a   n o d e   t h a t   h o s t s   t h e   b a c k e n d   P o d   f o r   a   S e r v i c e   c a n   a p p l y   t h e   p a c k e t   r e w r i t i n g   d i r e c t l y ,   r a t h e r   t h a n   p l a c i n g   t h i s   b u r d e n   o n   t h e   n o d e   w h e r e   t h e   c l i e n t   P o d   i s   r u n n i n g .   T h i s   i s   c a l l e d   d i r e c t   s e r v e r   r e t u r n .   T o   u s e   t h i s ,   y o u   m u s t   r u n   k u b e - p r o x y   w i t h   t h e   - - e n a b l e - d s r   c o m m a n d   l i n e   a r g u m e n t   a n d   e n a b l e   t h e   W i n D S R   f e a t u r e   g a t e .   D i r e c t   s e r v e r   r e t u r n   a l s o   o p t i m i z e s   t h e   c a s e   f o r   P o d   r e t u r n   t r a f f i c   e v e n   w h e n   b o t h   P o d s   a r e   r u n n i n g   o n   t h e   s a m e   n o d e .


Question: What is Session affinity?

Answer: I n   t h e s e   p r o x y   m o d e l s ,   t h e   t r a f f i c   b o u n d   f o r   t h e   S e r v i c e ' s   I P : P o r t   i s   p r o x i e d   t o   a n   a p p r o p r i a t e   b a c k e n d   w i t h o u t   t h e   c l i e n t s   k n o w i n g   a n y t h i n g   a b o u t   K u b e r n e t e s   o r   S e r v i c e s   o r   P o d s .   I f   y o u   w a n t   t o   m a k e   s u r e   t h a t   c o n n e c t i o n s   f r o m   a   p a r t i c u l a r   c l i e n t   a r e   p a s s e d   t o   t h e   s a m e   P o d   e a c h   t i m e ,   y o u   c a n   s e l e c t   t h e   s e s s i o n   a f f i n i t y   b a s e d   o n   t h e   c l i e n t ' s   I P   a d d r e s s e s   b y   s e t t i n g   . s p e c . s e s s i o n A f f i n i t y   t o   C l i e n t I P   f o r   a   S e r v i c e   ( t h e   d e f a u l t   i s   N o n e ) .


Question: What is Session stickiness timeout?

Answer: Y o u   c a n   a l s o   s e t   t h e   m a x i m u m   s e s s i o n   s t i c k y   t i m e   b y   s e t t i n g   . s p e c . s e s s i o n A f f i n i t y C o n f i g . c l i e n t I P . t i m e o u t S e c o n d s   a p p r o p r i a t e l y   f o r   a   S e r v i c e .   ( t h e   d e f a u l t   v a l u e   i s   1 0 8 0 0 ,   w h i c h   w o r k s   o u t   t o   b e   3   h o u r s ) .


Question: What is IP address assignment to Services?

Answer: U n l i k e   P o d   I P   a d d r e s s e s ,   w h i c h   a c t u a l l y   r o u t e   t o   a   f i x e d   d e s t i n a t i o n ,   S e r v i c e   I P s   a r e   n o t   a c t u a l l y   a n s w e r e d   b y   a   s i n g l e   h o s t .   I n s t e a d ,   k u b e - p r o x y   u s e s   p a c k e t   p r o c e s s i n g   l o g i c   ( s u c h   a s   L i n u x   i p t a b l e s )   t o   d e f i n e   v i r t u a l   I P   a d d r e s s e s   w h i c h   a r e   t r a n s p a r e n t l y   r e d i r e c t e d   a s   n e e d e d .   W h e n   c l i e n t s   c o n n e c t   t o   t h e   V I P ,   t h e i r   t r a f f i c   i s   a u t o m a t i c a l l y   t r a n s p o r t e d   t o   a n   a p p r o p r i a t e   e n d p o i n t .   T h e   e n v i r o n m e n t   v a r i a b l e s   a n d   D N S   f o r   S e r v i c e s   a r e   a c t u a l l y   p o p u l a t e d   i n   t e r m s   o f   t h e   S e r v i c e ' s   v i r t u a l   I P   a d d r e s s   ( a n d   p o r t ) .


Question: What is Avoiding collisions?

Answer: O n e   o f   t h e   p r i m a r y   p h i l o s o p h i e s   o f   K u b e r n e t e s   i s   t h a t   y o u   s h o u l d   n o t   b e   e x p o s e d   t o   s i t u a t i o n s   t h a t   c o u l d   c a u s e   y o u r   a c t i o n s   t o   f a i l   t h r o u g h   n o   f a u l t   o f   y o u r   o w n .   F o r   t h e   d e s i g n   o f   t h e   S e r v i c e   r e s o u r c e ,   t h i s   m e a n s   n o t   m a k i n g   y o u   c h o o s e   y o u r   o w n   I P   a d d r e s s   i f   t h a t   c h o i c e   m i g h t   c o l l i d e   w i t h   s o m e o n e   e l s e ' s   c h o i c e .   T h a t   i s   a n   i s o l a t i o n   f a i l u r e .   I n   o r d e r   t o   a l l o w   y o u   t o   c h o o s e   a n   I P   a d d r e s s   f o r   y o u r   S e r v i c e s ,   w e   m u s t   e n s u r e   t h a t   n o   t w o   S e r v i c e s   c a n   c o l l i d e .   K u b e r n e t e s   d o e s   t h a t   b y   a l l o c a t i n g   e a c h   S e r v i c e   i t s   o w n   I P   a d d r e s s   f r o m   w i t h i n   t h e   s e r v i c e - c l u s t e r - i p - r a n g e   C I D R   r a n g e   t h a t   i s   c o n f i g u r e d   f o r   t h e   A P I   S e r v e r .


Question: What is IP address allocation tracking?

Answer: T o   e n s u r e   e a c h   S e r v i c e   r e c e i v e s   a   u n i q u e   I P   a d d r e s s ,   a n   i n t e r n a l   a l l o c a t o r   a t o m i c a l l y   u p d a t e s   a   g l o b a l   a l l o c a t i o n   m a p   i n   e t c d   p r i o r   t o   c r e a t i n g   e a c h   S e r v i c e .   T h e   m a p   o b j e c t   m u s t   e x i s t   i n   t h e   r e g i s t r y   f o r   S e r v i c e s   t o   g e t   I P   a d d r e s s   a s s i g n m e n t s ,   o t h e r w i s e   c r e a t i o n s   w i l l   f a i l   w i t h   a   m e s s a g e   i n d i c a t i n g   a n   I P   a d d r e s s   c o u l d   n o t   b e   a l l o c a t e d .   I n   t h e   c o n t r o l   p l a n e ,   a   b a c k g r o u n d   c o n t r o l l e r   i s   r e s p o n s i b l e   f o r   c r e a t i n g   t h a t   m a p   ( n e e d e d   t o   s u p p o r t   m i g r a t i n g   f r o m   o l d e r   v e r s i o n s   o f   K u b e r n e t e s   t h a t   u s e d   i n - m e m o r y   l o c k i n g ) .   K u b e r n e t e s   a l s o   u s e s   c o n t r o l l e r s   t o   c h e c k   f o r   i n v a l i d   a s s i g n m e n t s   ( f o r   e x a m p l e :   d u e   t o   a d m i n i s t r a t o r   i n t e r v e n t i o n )   a n d   f o r   c l e a n i n g   u p   a l l o c a t e d   I P   a d d r e s s e s   t h a t   a r e   n o   l o n g e r   u s e d   b y   a n y   S e r v i c e s .


Question: What is IP address allocation tracking using the Kubernetes API?

Answer: T h e   c o n t r o l   p l a n e   r e p l a c e s   t h e   e x i s t i n g   e t c d   a l l o c a t o r   w i t h   a   r e v i s e d   i m p l e m e n t a t i o n   t h a t   u s e s   I P A d d r e s s   a n d   S e r v i c e C I D R   o b j e c t s   i n s t e a d   o f   a n   i n t e r n a l   g l o b a l   a l l o c a t i o n   m a p .   E a c h   c l u s t e r   I P   a d d r e s s   a s s o c i a t e d   t o   a   S e r v i c e   t h e n   r e f e r e n c e s   a n   I P A d d r e s s   o b j e c t .   E n a b l i n g   t h e   f e a t u r e   g a t e   a l s o   r e p l a c e s   a   b a c k g r o u n d   c o n t r o l l e r   w i t h   a n   a l t e r n a t i v e   t h a t   h a n d l e s   t h e   I P A d d r e s s   o b j e c t s   a n d   s u p p o r t s   m i g r a t i o n   f r o m   t h e   o l d   a l l o c a t o r   m o d e l .   K u b e r n e t e s   1 . 3 4   d o e s   n o t   s u p p o r t   m i g r a t i n g   f r o m   I P A d d r e s s   o b j e c t s   t o   t h e   i n t e r n a l   a l l o c a t i o n   m a p .   O n e   o f   t h e   m a i n   b e n e f i t s   o f   t h e   r e v i s e d   a l l o c a t o r   i s   t h a t   i t   r e m o v e s   t h e   s i z e   l i m i t a t i o n s   f o r   t h e   I P   a d d r e s s   r a n g e   t h a t   c a n   b e   u s e d   f o r   t h e   c l u s t e r   I P   a d d r e s s   o f   S e r v i c e s .   W i t h   M u l t i C I D R S e r v i c e A l l o c a t o r   e n a b l e d ,   t h e r e   a r e   n o   l i m i t a t i o n s   f o r   I P v 4 ,   a n d   f o r   I P v 6   y o u   c a n   u s e   I P   a d d r e s s   n e t m a s k s   t h a t   a r e   a   / 6 4   o r   s m a l l e r   ( a s   o p p o s e d   t o   / 1 0 8   w i t h   t h e   l e g a c y   i m p l e m e n t a t i o n ) .   M a k i n g   I P   a d d r e s s   a l l o c a t i o n s   a v a i l a b l e   v i a   t h e   A P I   m e a n s   t h a t   y o u   a s   a   c l u s t e r   a d m i n i s t r a t o r   c a n   a


Question: What is IP address ranges for Service virtual IP addresses?

Answer: K u b e r n e t e s   d i v i d e s   t h e   C l u s t e r I P   r a n g e   i n t o   t w o   b a n d s ,   b a s e d   o n   t h e   s i z e   o f   t h e   c o n f i g u r e d   s e r v i c e - c l u s t e r - i p - r a n g e   b y   u s i n g   t h e   f o l l o w i n g   f o r m u l a   m i n ( m a x ( 1 6 ,   c i d r S i z e   /   1 6 ) ,   2 5 6 ) .   T h a t   f o r m u l a   m e a n s   t h e   r e s u l t   i s   n e v e r   l e s s   t h a n   1 6   o r   m o r e   t h a n   2 5 6 ,   w i t h   a   g r a d u a t e d   s t e p   f u n c t i o n   b e t w e e n   t h e m .   K u b e r n e t e s   p r e f e r s   t o   a l l o c a t e   d y n a m i c   I P   a d d r e s s e s   t o   S e r v i c e s   b y   c h o o s i n g   f r o m   t h e   u p p e r   b a n d ,   w h i c h   m e a n s   t h a t   i f   y o u   w a n t   t o   a s s i g n   a   s p e c i f i c   I P   a d d r e s s   t o   a   t y p e :   C l u s t e r I P   S e r v i c e ,   y o u   s h o u l d   m a n u a l l y   a s s i g n   a n   I P   a d d r e s s   f r o m   t h e   l o w e r   b a n d .   T h a t   a p p r o a c h   r e d u c e s   t h e   r i s k   o f   a   c o n f l i c t   o v e r   a l l o c a t i o n .


Question: What is Traffic policies?

Answer: Y o u   c a n   s e t   t h e   . s p e c . i n t e r n a l T r a f f i c P o l i c y   a n d   . s p e c . e x t e r n a l T r a f f i c P o l i c y   f i e l d s   t o   c o n t r o l   h o w   K u b e r n e t e s   r o u t e s   t r a f f i c   t o   h e a l t h y   ( “ r e a d y ” )   b a c k e n d s .


Question: What is Internal traffic policy?

Answer: Y o u   c a n   s e t   t h e   . s p e c . i n t e r n a l T r a f f i c P o l i c y   f i e l d   t o   c o n t r o l   h o w   t r a f f i c   f r o m   i n t e r n a l   s o u r c e s   i s   r o u t e d .   V a l i d   v a l u e s   a r e   C l u s t e r   a n d   L o c a l .   S e t   t h e   f i e l d   t o   C l u s t e r   t o   r o u t e   i n t e r n a l   t r a f f i c   t o   a l l   r e a d y   e n d p o i n t s   a n d   L o c a l   t o   o n l y   r o u t e   t o   r e a d y   n o d e - l o c a l   e n d p o i n t s .   I f   t h e   t r a f f i c   p o l i c y   i s   L o c a l   a n d   t h e r e   a r e   n o   n o d e - l o c a l   e n d p o i n t s ,   t r a f f i c   i s   d r o p p e d   b y   k u b e - p r o x y .


Question: What is External traffic policy?

Answer: Y o u   c a n   s e t   t h e   . s p e c . e x t e r n a l T r a f f i c P o l i c y   f i e l d   t o   c o n t r o l   h o w   t r a f f i c   f r o m   e x t e r n a l   s o u r c e s   i s   r o u t e d .   V a l i d   v a l u e s   a r e   C l u s t e r   a n d   L o c a l .   S e t   t h e   f i e l d   t o   C l u s t e r   t o   r o u t e   e x t e r n a l   t r a f f i c   t o   a l l   r e a d y   e n d p o i n t s   a n d   L o c a l   t o   o n l y   r o u t e   t o   r e a d y   n o d e - l o c a l   e n d p o i n t s .   I f   t h e   t r a f f i c   p o l i c y   i s   L o c a l   a n d   t h e r e   a r e   n o   n o d e - l o c a l   e n d p o i n t s ,   t h e   k u b e - p r o x y   d o e s   n o t   f o r w a r d   a n y   t r a f f i c   f o r   t h e   r e l e v a n t   S e r v i c e .   I f   C l u s t e r   i s   s p e c i f i e d ,   a l l   n o d e s   a r e   e l i g i b l e   l o a d   b a l a n c i n g   t a r g e t s   a s   l o n g   a s   t h e   n o d e   i s   n o t   b e i n g   d e l e t e d   a n d   k u b e - p r o x y   i s   h e a l t h y .   I n   t h i s   m o d e :   l o a d   b a l a n c e r   h e a l t h   c h e c k s   a r e   c o n f i g u r e d   t o   t a r g e t   t h e   s e r v i c e   p r o x y ' s   r e a d i n e s s   p o r t   a n d   p a t h .   I n   t h e   c a s e   o f   k u b e - p r o x y   t h i s   e v a l u a t e s   t o :   $ { N O D E _ I P } : 1 0 2 5 6 / h e a l t h z .   k u b e - p r o x y   w i l l   r e t u r n   e i t h e r   a n   H T T P   c o d e   2 0 0   o r   5 0 3 .   k u b e - p r o x y ' s   l o a d   b a l a n c e r   h e a l t h   c h e c k   e n d p o i n t   r e t u r n s   2 0 0   i f :   k u b e - p r o x y   i s   h e a l t h y ,   m e a n i n g : i t ' s   a b l e   t o   p r o g r e s s   p r o g r a m m i n g   t h e   n e t w o r k   a n d   i s n ' t   t i m i n g   o u t   w h i l e   d o i n g   s o   ( t h e   t i m e o u t   i s   d e f i n e d   t o   b e :   2   ×


Question: What is Traffic to terminating endpoints?

Answer: I f   t h e   P r o x y T e r m i n a t i n g E n d p o i n t s   f e a t u r e   g a t e   i s   e n a b l e d   i n   k u b e - p r o x y   a n d   t h e   t r a f f i c   p o l i c y   i s   L o c a l ,   t h a t   n o d e ' s   k u b e - p r o x y   u s e s   a   m o r e   c o m p l i c a t e d   a l g o r i t h m   t o   s e l e c t   e n d p o i n t s   f o r   a   S e r v i c e .   W i t h   t h e   f e a t u r e   e n a b l e d ,   k u b e - p r o x y   c h e c k s   i f   t h e   n o d e   h a s   l o c a l   e n d p o i n t s   a n d   w h e t h e r   o r   n o t   a l l   t h e   l o c a l   e n d p o i n t s   a r e   m a r k e d   a s   t e r m i n a t i n g .   I f   t h e r e   a r e   l o c a l   e n d p o i n t s   a n d   a l l   o f   t h e m   a r e   t e r m i n a t i n g ,   t h e n   k u b e - p r o x y   w i l l   f o r w a r d   t r a f f i c   t o   t h o s e   t e r m i n a t i n g   e n d p o i n t s .   O t h e r w i s e ,   k u b e - p r o x y   w i l l   a l w a y s   p r e f e r   f o r w a r d i n g   t r a f f i c   t o   e n d p o i n t s   t h a t   a r e   n o t   t e r m i n a t i n g .   T h i s   f o r w a r d i n g   b e h a v i o r   f o r   t e r m i n a t i n g   e n d p o i n t s   e x i s t s   t o   a l l o w   N o d e P o r t   a n d   L o a d B a l a n c e r   S e r v i c e s   t o   g r a c e f u l l y   d r a i n   c o n n e c t i o n s   w h e n   u s i n g   e x t e r n a l T r a f f i c P o l i c y :   L o c a l .   A s   a   d e p l o y m e n t   g o e s   t h r o u g h   a   r o l l i n g   u p d a t e ,   n o d e s   b a c k i n g   a   l o a d   b a l a n c e r   m a y   t r a n s i t i o n   f r o m   N   t o   0   r e p l i c a s   o f   t h a t   d e p l o y m e n t .   I n   s o m e   c a s e s ,   e x t e r n a l   l o a d   b a l a n c e r s   c a n   s e n d   t r a f f i c   t o   a   n o d e   w i t h   0   r e p l i c a s   i n   b e t w e e n   h e a l t h   c h e c k   p r o b e s .   R o u t i n


Question: What is Traffic Distribution?

Answer: T h e   s p e c . t r a f f i c D i s t r i b u t i o n   f i e l d   w i t h i n   a   K u b e r n e t e s   S e r v i c e   a l l o w s   y o u   t o   e x p r e s s   p r e f e r e n c e s   f o r   h o w   t r a f f i c   s h o u l d   b e   r o u t e d   t o   S e r v i c e   e n d p o i n t s .   I n   K u b e r n e t e s   1 . 3 4 ,   t w o   a d d i t i o n a l   v a l u e s   a r e   a v a i l a b l e   ( u n l e s s   t h e   P r e f e r S a m e T r a f f i c D i s t r i b u t i o n   f e a t u r e   g a t e   i s   d i s a b l e d ) :   I n   t h e   a b s e n c e   o f   a n y   v a l u e   f o r   t r a f f i c D i s t r i b u t i o n ,   t h e   d e f a u l t   s t r a t e g y   i s   t o   d i s t r i b u t e   t r a f f i c   e v e n l y   t o   a l l   e n d p o i n t s   i n   t h e   c l u s t e r .


Question: What is Comparison with service.kubernetes.io/topology-mode: Auto?

Answer: T h e   t r a f f i c D i s t r i b u t i o n   f i e l d   w i t h   P r e f e r C l o s e / P r e f e r S a m e Z o n e ,   a n d   t h e   o l d e r   " T o p o l o g y - A w a r e   R o u t i n g "   f e a t u r e   u s i n g   t h e   s e r v i c e . k u b e r n e t e s . i o / t o p o l o g y - m o d e :   A u t o   a n n o t a t i o n   b o t h   a i m   t o   p r i o r i t i z e   s a m e - z o n e   t r a f f i c .   H o w e v e r ,   t h e r e   i s   a   k e y   d i f f e r e n c e   i n   t h e i r   a p p r o a c h e s :   s e r v i c e . k u b e r n e t e s . i o / t o p o l o g y - m o d e :   A u t o   a t t e m p t s   t o   d i s t r i b u t e   t r a f f i c   p r o p o r t i o n a l l y   a c r o s s   z o n e s   b a s e d   o n   a l l o c a t a b l e   C P U   r e s o u r c e s .   T h i s   h e u r i s t i c   i n c l u d e s   s a f e g u a r d s   ( s u c h   a s   t h e   f a l l b a c k   b e h a v i o r   f o r   s m a l l   n u m b e r s   o f   e n d p o i n t s ) ,   s a c r i f i c i n g   s o m e   p r e d i c t a b i l i t y   i n   f a v o r   o f   p o t e n t i a l l y   b e t t e r   l o a d   b a l a n c i n g . t r a f f i c D i s t r i b u t i o n :   P r e f e r C l o s e   a i m s   t o   b e   s i m p l e r   a n d   m o r e   p r e d i c t a b l e :   " I f   t h e r e   a r e   e n d p o i n t s   i n   t h e   z o n e ,   t h e y   w i l l   r e c e i v e   a l l   t r a f f i c   f o r   t h a t   z o n e ,   i f   t h e r e   a r e   n o   e n d p o i n t s   i n   a   z o n e ,   t h e   t r a f f i c   w i l l   b e   d i s t r i b u t e d   t o   o t h e r   z o n e s " .   T h i s   a p p r o a c h   o f f e r s   m o r e   p r e d i c t a b i l i t y ,   b u t   i t   m e a n s   t h a t   y o u   a r e   r e s p o n s i b l e   f o r   a v o i d i n g   e n d p o i n t   o v e r l o a d .   s e r v i c e . k u b e r n e t e s . i o / t o p o l o g y - m o d e :   A u t o   a t t e m p t s   t o   d i s t r i b


Question: What is Interaction with Traffic Policies?

Answer: W h e n   c o m p a r e d   t o   t h e   t r a f f i c D i s t r i b u t i o n   f i e l d ,   t h e   t r a f f i c   p o l i c y   f i e l d s   ( e x t e r n a l T r a f f i c P o l i c y   a n d   i n t e r n a l T r a f f i c P o l i c y )   a r e   m e a n t   t o   o f f e r   a   s t r i c t e r   t r a f f i c   l o c a l i t y   r e q u i r e m e n t s .   H e r e ' s   h o w   t r a f f i c D i s t r i b u t i o n   i n t e r a c t s   w i t h   t h e m :   P r e c e d e n c e   o f   T r a f f i c   P o l i c i e s :   F o r   a   g i v e n   S e r v i c e ,   i f   a   t r a f f i c   p o l i c y   ( e x t e r n a l T r a f f i c P o l i c y   o r   i n t e r n a l T r a f f i c P o l i c y )   i s   s e t   t o   L o c a l ,   i t   t a k e s   p r e c e d e n c e   o v e r   t r a f f i c D i s t r i b u t i o n   f o r   t h e   c o r r e s p o n d i n g   t r a f f i c   t y p e   ( e x t e r n a l   o r   i n t e r n a l ,   r e s p e c t i v e l y ) . t r a f f i c D i s t r i b u t i o n   I n f l u e n c e :   F o r   a   g i v e n   S e r v i c e ,   i f   a   t r a f f i c   p o l i c y   ( e x t e r n a l T r a f f i c P o l i c y   o r   i n t e r n a l T r a f f i c P o l i c y )   i s   s e t   t o   C l u s t e r   ( t h e   d e f a u l t ) ,   o r   i f   t h e   f i e l d s   a r e   n o t   s e t ,   t h e n   t r a f f i c D i s t r i b u t i o n   g u i d e s   t h e   r o u t i n g   b e h a v i o r   f o r   t h e   c o r r e s p o n d i n g   t r a f f i c   t y p e   ( e x t e r n a l   o r   i n t e r n a l ,   r e s p e c t i v e l y ) .   T h i s   m e a n s   t h a t   a n   a t t e m p t   w i l l   b e   m a d e   t o   r o u t e   t r a f f i c   t o   a n   e n d p o i n t   t h a t   i s   i n   t h e   s a m e   z o n e   a s   t h e   c l i e n t .   P r e c e d e n c e   o f   T r a f f i c   P o l i c i e s :   F o r   a   g i v e n   S e r v i c e ,   i f   a   t r a f f i c   p o l i c y   ( e x t e r n a l T r a


Question: What is Considerations for using traffic distribution control?

Answer: A   S e r v i c e   u s i n g   t r a f f i c D i s t r i b u t i o n   w i l l   a t t e m p t   t o   r o u t e   t r a f f i c   t o   ( h e a l t h y )   e n d p o i n t s   w i t h i n   t h e   a p p r o p r i a t e   t o p o l o g y ,   e v e n   i f   t h i s   m e a n s   t h a t   s o m e   e n d p o i n t s   r e c e i v e   m u c h   m o r e   t r a f f i c   t h a n   o t h e r   e n d p o i n t s .   I f   y o u   d o   n o t   h a v e   a   s u f f i c i e n t   n u m b e r   o f   e n d p o i n t s   w i t h i n   t h e   s a m e   t o p o l o g y   ( " s a m e   z o n e " ,   " s a m e   n o d e " ,   e t c . )   a s   t h e   c l i e n t s ,   t h e n   e n d p o i n t s   m a y   b e c o m e   o v e r l o a d e d .   T h i s   i s   e s p e c i a l l y   l i k e l y   i f   i n c o m i n g   t r a f f i c   i s   n o t   p r o p o r t i o n a l l y   d i s t r i b u t e d   a c r o s s   t h e   t o p o l o g y .   T o   m i t i g a t e   t h i s ,   c o n s i d e r   t h e   f o l l o w i n g   s t r a t e g i e s :   P o d   T o p o l o g y   S p r e a d   C o n s t r a i n t s :   U s e   P o d   T o p o l o g y   S p r e a d   C o n s t r a i n t s   t o   d i s t r i b u t e   y o u r   p o d s   e v e n l y   a c r o s s   z o n e s   o r   n o d e s . Z o n e - s p e c i f i c   D e p l o y m e n t s :   I f   y o u   a r e   u s i n g   " s a m e   z o n e "   t r a f f i c   d i s t r i b u t i o n ,   b u t   e x p e c t   t o   s e e   d i f f e r e n t   t r a f f i c   p a t t e r n s   i n   d i f f e r e n t   z o n e s ,   y o u   c a n   c r e a t e   a   s e p a r a t e   D e p l o y m e n t   f o r   e a c h   z o n e .   T h i s   a p p r o a c h   a l l o w s   t h e   s e p a r a t e   w o r k l o a d s   t o   s c a l e   i n d e p e n d e n t l y .   T h e r e   a r e   a l s o   w o r k l o a d   m a n a g e m e n t   a d d o n s   a v a i l a b l e   f r o m   t h e   e c o s y s t e m ,   o u t s i d e   t h e   K u b e


Question: What is What's next?

Answer: T o   l e a r n   m o r e   a b o u t   S e r v i c e s ,   r e a d   C o n n e c t i n g   A p p l i c a t i o n s   w i t h   S e r v i c e s .   Y o u   c a n   a l s o :   R e a d   a b o u t   S e r v i c e s   a s   a   c o n c e p t R e a d   a b o u t   I n g r e s s e s   a s   a   c o n c e p t R e a d   t h e   A P I   r e f e r e n c e   f o r   t h e   S e r v i c e   A P I


Question: What is Common Expression Language in Kubernetes?

Answer: Common Expression Language in KubernetesThe Common Expression Language (CEL) is used in the Kubernetes API to declare validation rules, policy rules, and other constraints or conditions.CEL expressions are evaluated directly in the API server, making CEL a convenient alternative to out-of-process mechanisms, such as webhooks, for many extensibility use cases. Your CEL expressions continue to execute so long as the control plane's API server component remains available.Language overviewThe CEL language has a straightforward syntax that is similar to the expressions in C, C++, Java, JavaScript and Go.CEL was designed to be embedded into applications. Each CEL "program" is a single expression that evaluates to a single value. CEL expressions are typically short "one-liners" that inline well into the string fields of Kubernetes API resources.Inputs to a CEL program are "variables". Each Kubernetes API field that contains CEL declares in the API documentation which variables are available to use for that field. For example, in the x-kubernetes-validations[i].rules field of CustomResourceDefinitions, the self and oldSelf variables are available and refer to the previous and current state of the custom resource data to be validated by the CEL expression. Other Kubernetes API fields may declare different variables. See the API documentation of the API fields to learn which variables are available for that field.Example CEL expressions:Examples of CEL expressions and the purpose of eachRulePurposeself.minReplicas <= self.replicas && self.replicas <= self.maxReplicasValidate that the three fields defining replicas are ordered appropriately'Available' in self.stateCountsValidate that an entry with the 'Available' key exists in a map(self.list1.size() == 0) != (self.list2.size() == 0)Validate that one of two lists is non-empty, but not bothself.envars.filter(e, e.name = 'MY_ENV').all(e, e.value.matches('^[a-zA-Z]*$'))Validate the 'value' field of a listMap entry where key field 'name' is 'MY_ENV'has(self.expired) && self.created + self.ttl < self.expiredValidate that 'expired' date is after a 'create' date plus a 'ttl' durationself.health.startsWith('ok')Validate a 'health' string field has the prefix 'ok'self.widgets.exists(w, w.key == 'x' && w.foo < 10)Validate that the 'foo' property of a listMap item with a key 'x' is less than 10type(self) == string ? self == '99%' : self == 42Validate an int-or-string field for both the int and string casesself.metadata.name == 'singleton'Validate that an object's name matches a specific value (making it a singleton)self.set1.all(e, !(e in self.set2))Validate that two listSets are disjointself.names.size() == self.details.size() && self.names.all(n, n in self.details)Validate the 'details' map is keyed by the items in the 'names' listSetself.details.all(key, key.matches('^[a-zA-Z]*$'))Validate the keys of the 'details' mapself.details.all(key, self.details[key].matches('^[a-zA-Z]*$'))Validate the values of the 'details


Question: How does Common Expression Language in Kubernetes work?

Answer: Common Expression Language in KubernetesThe Common Expression Language (CEL) is used in the Kubernetes API to declare validation rules, policy rules, and other constraints or conditions.CEL expressions are evaluated directly in the API server, making CEL a convenient alternative to out-of-process mechanisms, such as webhooks, for many extensibility use cases. Your CEL expressions continue to execute so long as the control plane's API server component remains available.Language overviewThe CEL language has a straightforward syntax that is similar to the expressions in C, C++, Java, JavaScript and Go.CEL was designed to be embedded into applications. Each CEL "program" is a single expression that evaluates to a single value. CEL expressions are typically short "one-liners" that inline well into the string fields of Kubernetes API resources.Inputs to a CEL program are "variables". Each Kubernetes API field that contains CEL declares in the API documentation which variables are available to use for that field. For example, in the x-kubernetes-validations[i].rules field of CustomResourceDefinitions, the self and oldSelf variables are available and refer to the previous and current state of the custom resource data to be validated by the CEL expression. Other Kubernetes API fields may declare different variables. See the API documentation of the API fields to learn which variables are available for that field.Example CEL expressions:Examples of CEL expressions and the purpose of eachRulePurposeself.minReplicas <= self.replicas && self.replicas <= self.maxReplicasValidate that the three fields defining replicas are ordered appropriately'Available' in self.stateCountsValidate that an entry with the 'Available' key exists in a map(self.list1.size() == 0) != (self.list2.size() == 0)Validate that one of two lists is non-empty, but not bothself.envars.filter(e, e.name = 'MY_ENV').all(e, e.value.matches('^[a-zA-Z]*$'))Validate the 'value' field of a listMap entry where key field 'name' is 'MY_ENV'has(self.expired) && self.created + self.ttl < self.expiredValidate that 'expired' date is after a 'create' date plus a 'ttl' durationself.health.startsWith('ok')Validate a 'health' string field has the prefix 'ok'self.widgets.exists(w, w.key == 'x' && w.foo < 10)Validate that the 'foo' property of a listMap item with a key 'x' is less than 10type(self) == string ? self == '99%' : self == 42Validate an int-or-string field for both the int and string casesself.metadata.name == 'singleton'Validate that an object's name matches a specific value (making it a singleton)self.set1.all(e, !(e in self.set2))Validate that two listSets are disjointself.names.size() == self.details.size() && self.names.all(n, n in self.details)Validate the 'details' map is keyed by the items in the 'names' listSetself.details.all(key, key.matches('^[a-zA-Z]*$'))Validate the keys of the 'details' mapself.details.all(key, self.details[key].matches('^[a-zA-Z]*$'))Validate the values of the 'details


Question: When would you use Common Expression Language in Kubernetes?

Answer: Common Expression Language in KubernetesThe Common Expression Language (CEL) is used in the Kubernetes API to declare validation rules, policy rules, and other constraints or conditions.CEL expressions are evaluated directly in the API server, making CEL a convenient alternative to out-of-process mechanisms, such as webhooks, for many extensibility use cases. Your CEL expressions continue to execute so long as the control plane's API server component remains available.Language overviewThe CEL language has a straightforward syntax that is similar to the expressions in C, C++, Java, JavaScript and Go.CEL was designed to be embedded into applications. Each CEL "program" is a single expression that evaluates to a single value. CEL expressions are typically short "one-liners" that inline well into the string fields of Kubernetes API resources.Inputs to a CEL program are "variables". Each Kubernetes API field that contains CEL declares in the API documentation which variables are available to use for that field. For example, in the x-kubernetes-validations[i].rules field of CustomResourceDefinitions, the self and oldSelf variables are available and refer to the previous and current state of the custom resource data to be validated by the CEL expression. Other Kubernetes API fields may declare different variables. See the API documentation of the API fields to learn which variables are available for that field.Example CEL expressions:Examples of CEL expressions and the purpose of eachRulePurposeself.minReplicas <= self.replicas && self.replicas <= self.maxReplicasValidate that the three fields defining replicas are ordered appropriately'Available' in self.stateCountsValidate that an entry with the 'Available' key exists in a map(self.list1.size() == 0) != (self.list2.size() == 0)Validate that one of two lists is non-empty, but not bothself.envars.filter(e, e.name = 'MY_ENV').all(e, e.value.matches('^[a-zA-Z]*$'))Validate the 'value' field of a listMap entry where key field 'name' is 'MY_ENV'has(self.expired) && self.created + self.ttl < self.expiredValidate that 'expired' date is after a 'create' date plus a 'ttl' durationself.health.startsWith('ok')Validate a 'health' string field has the prefix 'ok'self.widgets.exists(w, w.key == 'x' && w.foo < 10)Validate that the 'foo' property of a listMap item with a key 'x' is less than 10type(self) == string ? self == '99%' : self == 42Validate an int-or-string field for both the int and string casesself.metadata.name == 'singleton'Validate that an object's name matches a specific value (making it a singleton)self.set1.all(e, !(e in self.set2))Validate that two listSets are disjointself.names.size() == self.details.size() && self.names.all(n, n in self.details)Validate the 'details' map is keyed by the items in the 'names' listSetself.details.all(key, key.matches('^[a-zA-Z]*$'))Validate the keys of the 'details' mapself.details.all(key, self.details[key].matches('^[a-zA-Z]*$'))Validate the values of the 'details


Question: What are the benefits of Common Expression Language in Kubernetes?

Answer: Common Expression Language in KubernetesThe Common Expression Language (CEL) is used in the Kubernetes API to declare validation rules, policy rules, and other constraints or conditions.CEL expressions are evaluated directly in the API server, making CEL a convenient alternative to out-of-process mechanisms, such as webhooks, for many extensibility use cases. Your CEL expressions continue to execute so long as the control plane's API server component remains available.Language overviewThe CEL language has a straightforward syntax that is similar to the expressions in C, C++, Java, JavaScript and Go.CEL was designed to be embedded into applications. Each CEL "program" is a single expression that evaluates to a single value. CEL expressions are typically short "one-liners" that inline well into the string fields of Kubernetes API resources.Inputs to a CEL program are "variables". Each Kubernetes API field that contains CEL declares in the API documentation which variables are available to use for that field. For example, in the x-kubernetes-validations[i].rules field of CustomResourceDefinitions, the self and oldSelf variables are available and refer to the previous and current state of the custom resource data to be validated by the CEL expression. Other Kubernetes API fields may declare different variables. See the API documentation of the API fields to learn which variables are available for that field.Example CEL expressions:Examples of CEL expressions and the purpose of eachRulePurposeself.minReplicas <= self.replicas && self.replicas <= self.maxReplicasValidate that the three fields defining replicas are ordered appropriately'Available' in self.stateCountsValidate that an entry with the 'Available' key exists in a map(self.list1.size() == 0) != (self.list2.size() == 0)Validate that one of two lists is non-empty, but not bothself.envars.filter(e, e.name = 'MY_ENV').all(e, e.value.matches('^[a-zA-Z]*$'))Validate the 'value' field of a listMap entry where key field 'name' is 'MY_ENV'has(self.expired) && self.created + self.ttl < self.expiredValidate that 'expired' date is after a 'create' date plus a 'ttl' durationself.health.startsWith('ok')Validate a 'health' string field has the prefix 'ok'self.widgets.exists(w, w.key == 'x' && w.foo < 10)Validate that the 'foo' property of a listMap item with a key 'x' is less than 10type(self) == string ? self == '99%' : self == 42Validate an int-or-string field for both the int and string casesself.metadata.name == 'singleton'Validate that an object's name matches a specific value (making it a singleton)self.set1.all(e, !(e in self.set2))Validate that two listSets are disjointself.names.size() == self.details.size() && self.names.all(n, n in self.details)Validate the 'details' map is keyed by the items in the 'names' listSetself.details.all(key, key.matches('^[a-zA-Z]*$'))Validate the keys of the 'details' mapself.details.all(key, self.details[key].matches('^[a-zA-Z]*$'))Validate the values of the 'details


Question: What is Common Expression Language in Kubernetes?

Answer: T h e   C o m m o n   E x p r e s s i o n   L a n g u a g e   ( C E L )   i s   u s e d   i n   t h e   K u b e r n e t e s   A P I   t o   d e c l a r e   v a l i d a t i o n   r u l e s ,   p o l i c y   r u l e s ,   a n d   o t h e r   c o n s t r a i n t s   o r   c o n d i t i o n s .   C E L   e x p r e s s i o n s   a r e   e v a l u a t e d   d i r e c t l y   i n   t h e   A P I   s e r v e r ,   m a k i n g   C E L   a   c o n v e n i e n t   a l t e r n a t i v e   t o   o u t - o f - p r o c e s s   m e c h a n i s m s ,   s u c h   a s   w e b h o o k s ,   f o r   m a n y   e x t e n s i b i l i t y   u s e   c a s e s .   Y o u r   C E L   e x p r e s s i o n s   c o n t i n u e   t o   e x e c u t e   s o   l o n g   a s   t h e   c o n t r o l   p l a n e ' s   A P I   s e r v e r   c o m p o n e n t   r e m a i n s   a v a i l a b l e .


Question: What is Language overview?

Answer: T h e   C E L   l a n g u a g e   h a s   a   s t r a i g h t f o r w a r d   s y n t a x   t h a t   i s   s i m i l a r   t o   t h e   e x p r e s s i o n s   i n   C ,   C + + ,   J a v a ,   J a v a S c r i p t   a n d   G o .   C E L   w a s   d e s i g n e d   t o   b e   e m b e d d e d   i n t o   a p p l i c a t i o n s .   E a c h   C E L   " p r o g r a m "   i s   a   s i n g l e   e x p r e s s i o n   t h a t   e v a l u a t e s   t o   a   s i n g l e   v a l u e .   C E L   e x p r e s s i o n s   a r e   t y p i c a l l y   s h o r t   " o n e - l i n e r s "   t h a t   i n l i n e   w e l l   i n t o   t h e   s t r i n g   f i e l d s   o f   K u b e r n e t e s   A P I   r e s o u r c e s .   I n p u t s   t o   a   C E L   p r o g r a m   a r e   " v a r i a b l e s " .   E a c h   K u b e r n e t e s   A P I   f i e l d   t h a t   c o n t a i n s   C E L   d e c l a r e s   i n   t h e   A P I   d o c u m e n t a t i o n   w h i c h   v a r i a b l e s   a r e   a v a i l a b l e   t o   u s e   f o r   t h a t   f i e l d .   F o r   e x a m p l e ,   i n   t h e   x - k u b e r n e t e s - v a l i d a t i o n s [ i ] . r u l e s   f i e l d   o f   C u s t o m R e s o u r c e D e f i n i t i o n s ,   t h e   s e l f   a n d   o l d S e l f   v a r i a b l e s   a r e   a v a i l a b l e   a n d   r e f e r   t o   t h e   p r e v i o u s   a n d   c u r r e n t   s t a t e   o f   t h e   c u s t o m   r e s o u r c e   d a t a   t o   b e   v a l i d a t e d   b y   t h e   C E L   e x p r e s s i o n .   O t h e r   K u b e r n e t e s   A P I   f i e l d s   m a y   d e c l a r e   d i f f e r e n t   v a r i a b l e s .   S e e   t h e   A P I   d o c u m e n t a t i o n   o f   t h e   A P I   f i e l d s   t o   l e a r n   w h i c h   v a r i a b l e s   a r e   a v a i l a b l e   f o r   t h a t   f i e l d .   E x a m p l e   C E L   e x p r e s s i o n s :


Question: What is CEL options, language features, and libraries?

Answer: C E L   i s   c o n f i g u r e d   w i t h   t h e   f o l l o w i n g   o p t i o n s ,   l i b r a r i e s   a n d   l a n g u a g e   f e a t u r e s ,   i n t r o d u c e d   a t   t h e   s p e c i f i e d   K u b e r n e t e s   v e r s i o n s :   C E L   f u n c t i o n s ,   f e a t u r e s   a n d   l a n g u a g e   s e t t i n g s   s u p p o r t   K u b e r n e t e s   c o n t r o l   p l a n e   r o l l b a c k s .   F o r   e x a m p l e ,   C E L   O p t i o n a l   V a l u e s   w a s   i n t r o d u c e d   a t   K u b e r n e t e s   1 . 2 9   a n d   s o   o n l y   A P I   s e r v e r s   a t   t h a t   v e r s i o n   o r   n e w e r   w i l l   a c c e p t   w r i t e   r e q u e s t s   t o   C E L   e x p r e s s i o n s   t h a t   u s e   C E L   O p t i o n a l   V a l u e s .   H o w e v e r ,   w h e n   a   c l u s t e r   i s   r o l l e d   b a c k   t o   K u b e r n e t e s   1 . 2 8   C E L   e x p r e s s i o n s   u s i n g   " C E L   O p t i o n a l   V a l u e s "   t h a t   a r e   a l r e a d y   s t o r e d   i n   A P I   r e s o u r c e s   w i l l   c o n t i n u e   t o   e v a l u a t e   c o r r e c t l y .


Question: What is Kubernetes CEL libraries?

Answer: I n   a d d i t i o n a l   t o   t h e   C E L   c o m m u n i t y   l i b r a r i e s ,   K u b e r n e t e s   i n c l u d e s   C E L   l i b r a r i e s   t h a t   a r e   a v a i l a b l e   e v e r y w h e r e   C E L   i s   u s e d   i n   K u b e r n e t e s .


Question: What is Kubernetes list library?

Answer: T h e   l i s t   l i b r a r y   i n c l u d e s   i n d e x O f   a n d   l a s t I n d e x O f ,   w h i c h   w o r k   s i m i l a r   t o   t h e   s t r i n g s   f u n c t i o n s   o f   t h e   s a m e   n a m e s .   T h e s e   f u n c t i o n s   e i t h e r   t h e   f i r s t   o r   l a s t   p o s i t i o n a l   i n d e x   o f   t h e   p r o v i d e d   e l e m e n t   i n   t h e   l i s t .   T h e   l i s t   l i b r a r y   a l s o   i n c l u d e s   m i n ,   m a x   a n d   s u m .   S u m   i s   s u p p o r t e d   o n   a l l   n u m b e r   t y p e s   a s   w e l l   a s   t h e   d u r a t i o n   t y p e .   M i n   a n d   m a x   a r e   s u p p o r t e d   o n   a l l   c o m p a r a b l e   t y p e s .   i s S o r t e d   i s   a l s o   p r o v i d e d   a s   a   c o n v e n i e n c e   f u n c t i o n   a n d   i s   s u p p o r t e d   o n   a l l   c o m p a r a b l e   t y p e s .   E x a m p l e s :   S e e   t h e   K u b e r n e t e s   L i s t   L i b r a r y   g o d o c   f o r   m o r e   i n f o r m a t i o n .


Question: What is Kubernetes regex library?

Answer: I n   a d d i t i o n   t o   t h e   m a t c h e s   f u n c t i o n   p r o v i d e d   b y   t h e   C E L   s t a n d a r d   l i b r a r y ,   t h e   r e g e x   l i b r a r y   p r o v i d e s   f i n d   a n d   f i n d A l l ,   e n a b l i n g   a   m u c h   w i d e r   r a n g e   o f   r e g e x   o p e r a t i o n s .   E x a m p l e s :   S e e   t h e   K u b e r n e t e s   r e g e x   l i b r a r y   g o d o c   f o r   m o r e   i n f o r m a t i o n .