Question: What is Scheduler Configuration?

Answer: Scheduler ConfigurationFEATURE STATE: Kubernetes v1.25 [stable]You can customize the behavior of the kube-scheduler by writing a configuration file and passing its path as a command line argument.A scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can specify scheduling profiles by running kube-scheduler --config <filename>, using the KubeSchedulerConfiguration v1 struct.A minimal configuration looks as follows:apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: /etc/srv/kubernetes/kube-scheduler/kubeconfig Note:KubeSchedulerConfiguration v1beta3 is deprecated in v1.26 and is removed in v1.29. Please migrate KubeSchedulerConfiguration to v1.ProfilesA scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can configure a single instance of kube-scheduler to run multiple profiles.Extension pointsScheduling happens in a series of stages that are exposed through the following extension points:queueSort: These plugins provide an ordering function that is used to sort pending Pods in the scheduling queue. Exactly one queue sort plugin may be enabled at a time.preFilter: These plugins are used to pre-process or check information about a Pod or the cluster before filtering. They can mark a pod as unschedulable.filter: These plugins are the equivalent of Predicates in a scheduling Policy and are used to filter out nodes that can not run the Pod. Filters are called in the configured order. A pod is marked as unschedulable if no nodes pass all the filters.postFilter: These plugins are called in their configured order when no feasible nodes were found for the pod. If any postFilter plugin marks the Pod schedulable, the remaining plugins are not called.preScore: This is an informational extension point that can be used for doing pre-scoring work.score: These plugins provide a score to each node that has passed the filtering phase. The scheduler will then select the node with the highest weighted scores sum.reserve: This is an informational extension point that notifies plugins when resources have been reserved for a given Pod. Plugins also implement an Unreserve call that gets called in the case of failure during or after Reserve.permit: These plugins can prevent or delay the binding of a Pod.preBind: These plugins perform any work required before a Pod is bound.bind: The plugins bind a Pod to a Node. bind plugins are called in order and once one has done the binding, the remaining plugins are skipped. At least one bind plugin is required.postBind: This is an informational extension point that is called after a Pod has been bound.multiP


Question: How does Scheduler Configuration work?

Answer: Scheduler ConfigurationFEATURE STATE: Kubernetes v1.25 [stable]You can customize the behavior of the kube-scheduler by writing a configuration file and passing its path as a command line argument.A scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can specify scheduling profiles by running kube-scheduler --config <filename>, using the KubeSchedulerConfiguration v1 struct.A minimal configuration looks as follows:apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: /etc/srv/kubernetes/kube-scheduler/kubeconfig Note:KubeSchedulerConfiguration v1beta3 is deprecated in v1.26 and is removed in v1.29. Please migrate KubeSchedulerConfiguration to v1.ProfilesA scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can configure a single instance of kube-scheduler to run multiple profiles.Extension pointsScheduling happens in a series of stages that are exposed through the following extension points:queueSort: These plugins provide an ordering function that is used to sort pending Pods in the scheduling queue. Exactly one queue sort plugin may be enabled at a time.preFilter: These plugins are used to pre-process or check information about a Pod or the cluster before filtering. They can mark a pod as unschedulable.filter: These plugins are the equivalent of Predicates in a scheduling Policy and are used to filter out nodes that can not run the Pod. Filters are called in the configured order. A pod is marked as unschedulable if no nodes pass all the filters.postFilter: These plugins are called in their configured order when no feasible nodes were found for the pod. If any postFilter plugin marks the Pod schedulable, the remaining plugins are not called.preScore: This is an informational extension point that can be used for doing pre-scoring work.score: These plugins provide a score to each node that has passed the filtering phase. The scheduler will then select the node with the highest weighted scores sum.reserve: This is an informational extension point that notifies plugins when resources have been reserved for a given Pod. Plugins also implement an Unreserve call that gets called in the case of failure during or after Reserve.permit: These plugins can prevent or delay the binding of a Pod.preBind: These plugins perform any work required before a Pod is bound.bind: The plugins bind a Pod to a Node. bind plugins are called in order and once one has done the binding, the remaining plugins are skipped. At least one bind plugin is required.postBind: This is an informational extension point that is called after a Pod has been bound.multiP


Question: When would you use Scheduler Configuration?

Answer: Scheduler ConfigurationFEATURE STATE: Kubernetes v1.25 [stable]You can customize the behavior of the kube-scheduler by writing a configuration file and passing its path as a command line argument.A scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can specify scheduling profiles by running kube-scheduler --config <filename>, using the KubeSchedulerConfiguration v1 struct.A minimal configuration looks as follows:apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: /etc/srv/kubernetes/kube-scheduler/kubeconfig Note:KubeSchedulerConfiguration v1beta3 is deprecated in v1.26 and is removed in v1.29. Please migrate KubeSchedulerConfiguration to v1.ProfilesA scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can configure a single instance of kube-scheduler to run multiple profiles.Extension pointsScheduling happens in a series of stages that are exposed through the following extension points:queueSort: These plugins provide an ordering function that is used to sort pending Pods in the scheduling queue. Exactly one queue sort plugin may be enabled at a time.preFilter: These plugins are used to pre-process or check information about a Pod or the cluster before filtering. They can mark a pod as unschedulable.filter: These plugins are the equivalent of Predicates in a scheduling Policy and are used to filter out nodes that can not run the Pod. Filters are called in the configured order. A pod is marked as unschedulable if no nodes pass all the filters.postFilter: These plugins are called in their configured order when no feasible nodes were found for the pod. If any postFilter plugin marks the Pod schedulable, the remaining plugins are not called.preScore: This is an informational extension point that can be used for doing pre-scoring work.score: These plugins provide a score to each node that has passed the filtering phase. The scheduler will then select the node with the highest weighted scores sum.reserve: This is an informational extension point that notifies plugins when resources have been reserved for a given Pod. Plugins also implement an Unreserve call that gets called in the case of failure during or after Reserve.permit: These plugins can prevent or delay the binding of a Pod.preBind: These plugins perform any work required before a Pod is bound.bind: The plugins bind a Pod to a Node. bind plugins are called in order and once one has done the binding, the remaining plugins are skipped. At least one bind plugin is required.postBind: This is an informational extension point that is called after a Pod has been bound.multiP


Question: What are the benefits of Scheduler Configuration?

Answer: Scheduler ConfigurationFEATURE STATE: Kubernetes v1.25 [stable]You can customize the behavior of the kube-scheduler by writing a configuration file and passing its path as a command line argument.A scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can specify scheduling profiles by running kube-scheduler --config <filename>, using the KubeSchedulerConfiguration v1 struct.A minimal configuration looks as follows:apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration clientConnection: kubeconfig: /etc/srv/kubernetes/kube-scheduler/kubeconfig Note:KubeSchedulerConfiguration v1beta3 is deprecated in v1.26 and is removed in v1.29. Please migrate KubeSchedulerConfiguration to v1.ProfilesA scheduling Profile allows you to configure the different stages of scheduling in the kube-scheduler. Each stage is exposed in an extension point. Plugins provide scheduling behaviors by implementing one or more of these extension points.You can configure a single instance of kube-scheduler to run multiple profiles.Extension pointsScheduling happens in a series of stages that are exposed through the following extension points:queueSort: These plugins provide an ordering function that is used to sort pending Pods in the scheduling queue. Exactly one queue sort plugin may be enabled at a time.preFilter: These plugins are used to pre-process or check information about a Pod or the cluster before filtering. They can mark a pod as unschedulable.filter: These plugins are the equivalent of Predicates in a scheduling Policy and are used to filter out nodes that can not run the Pod. Filters are called in the configured order. A pod is marked as unschedulable if no nodes pass all the filters.postFilter: These plugins are called in their configured order when no feasible nodes were found for the pod. If any postFilter plugin marks the Pod schedulable, the remaining plugins are not called.preScore: This is an informational extension point that can be used for doing pre-scoring work.score: These plugins provide a score to each node that has passed the filtering phase. The scheduler will then select the node with the highest weighted scores sum.reserve: This is an informational extension point that notifies plugins when resources have been reserved for a given Pod. Plugins also implement an Unreserve call that gets called in the case of failure during or after Reserve.permit: These plugins can prevent or delay the binding of a Pod.preBind: These plugins perform any work required before a Pod is bound.bind: The plugins bind a Pod to a Node. bind plugins are called in order and once one has done the binding, the remaining plugins are skipped. At least one bind plugin is required.postBind: This is an informational extension point that is called after a Pod has been bound.multiP


Question: What is Scheduler Configuration?

Answer: Y o u   c a n   c u s t o m i z e   t h e   b e h a v i o r   o f   t h e   k u b e - s c h e d u l e r   b y   w r i t i n g   a   c o n f i g u r a t i o n   f i l e   a n d   p a s s i n g   i t s   p a t h   a s   a   c o m m a n d   l i n e   a r g u m e n t .   A   s c h e d u l i n g   P r o f i l e   a l l o w s   y o u   t o   c o n f i g u r e   t h e   d i f f e r e n t   s t a g e s   o f   s c h e d u l i n g   i n   t h e   k u b e - s c h e d u l e r .   E a c h   s t a g e   i s   e x p o s e d   i n   a n   e x t e n s i o n   p o i n t .   P l u g i n s   p r o v i d e   s c h e d u l i n g   b e h a v i o r s   b y   i m p l e m e n t i n g   o n e   o r   m o r e   o f   t h e s e   e x t e n s i o n   p o i n t s .   Y o u   c a n   s p e c i f y   s c h e d u l i n g   p r o f i l e s   b y   r u n n i n g   k u b e - s c h e d u l e r   - - c o n f i g   < f i l e n a m e > ,   u s i n g   t h e   K u b e S c h e d u l e r C o n f i g u r a t i o n   v 1   s t r u c t .   A   m i n i m a l   c o n f i g u r a t i o n   l o o k s   a s   f o l l o w s :   a p i V e r s i o n :   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1   k i n d :   K u b e S c h e d u l e r C o n f i g u r a t i o n   c l i e n t C o n n e c t i o n :   k u b e c o n f i g :   / e t c / s r v / k u b e r n e t e s / k u b e - s c h e d u l e r / k u b e c o n f i g


Question: What is Profiles?

Answer: A   s c h e d u l i n g   P r o f i l e   a l l o w s   y o u   t o   c o n f i g u r e   t h e   d i f f e r e n t   s t a g e s   o f   s c h e d u l i n g   i n   t h e   k u b e - s c h e d u l e r .   E a c h   s t a g e   i s   e x p o s e d   i n   a n   e x t e n s i o n   p o i n t .   P l u g i n s   p r o v i d e   s c h e d u l i n g   b e h a v i o r s   b y   i m p l e m e n t i n g   o n e   o r   m o r e   o f   t h e s e   e x t e n s i o n   p o i n t s .   Y o u   c a n   c o n f i g u r e   a   s i n g l e   i n s t a n c e   o f   k u b e - s c h e d u l e r   t o   r u n   m u l t i p l e   p r o f i l e s .


Question: What is Extension points?

Answer: S c h e d u l i n g   h a p p e n s   i n   a   s e r i e s   o f   s t a g e s   t h a t   a r e   e x p o s e d   t h r o u g h   t h e   f o l l o w i n g   e x t e n s i o n   p o i n t s :   q u e u e S o r t :   T h e s e   p l u g i n s   p r o v i d e   a n   o r d e r i n g   f u n c t i o n   t h a t   i s   u s e d   t o   s o r t   p e n d i n g   P o d s   i n   t h e   s c h e d u l i n g   q u e u e .   E x a c t l y   o n e   q u e u e   s o r t   p l u g i n   m a y   b e   e n a b l e d   a t   a   t i m e . p r e F i l t e r :   T h e s e   p l u g i n s   a r e   u s e d   t o   p r e - p r o c e s s   o r   c h e c k   i n f o r m a t i o n   a b o u t   a   P o d   o r   t h e   c l u s t e r   b e f o r e   f i l t e r i n g .   T h e y   c a n   m a r k   a   p o d   a s   u n s c h e d u l a b l e . f i l t e r :   T h e s e   p l u g i n s   a r e   t h e   e q u i v a l e n t   o f   P r e d i c a t e s   i n   a   s c h e d u l i n g   P o l i c y   a n d   a r e   u s e d   t o   f i l t e r   o u t   n o d e s   t h a t   c a n   n o t   r u n   t h e   P o d .   F i l t e r s   a r e   c a l l e d   i n   t h e   c o n f i g u r e d   o r d e r .   A   p o d   i s   m a r k e d   a s   u n s c h e d u l a b l e   i f   n o   n o d e s   p a s s   a l l   t h e   f i l t e r s . p o s t F i l t e r :   T h e s e   p l u g i n s   a r e   c a l l e d   i n   t h e i r   c o n f i g u r e d   o r d e r   w h e n   n o   f e a s i b l e   n o d e s   w e r e   f o u n d   f o r   t h e   p o d .   I f   a n y   p o s t F i l t e r   p l u g i n   m a r k s   t h e   P o d   s c h e d u l a b l e ,   t h e   r e m a i n i n g   p l u g i n s   a r e   n o t   c a l l e d . p r e S c o r e :   T h i s   i s   a n   i n f o r m a t i o n a l   e x t e n s i o n   p o i n t   t h a t   c a n   b e   u s e d   f o r   d o i n g   p r e - s c o r i n g   w o r k . s c o r e :   T h e s e   p l u g i n s   p r o v i d e   a   s c o r e   t o   e


Question: What is Scheduling plugins?

Answer: T h e   f o l l o w i n g   p l u g i n s ,   e n a b l e d   b y   d e f a u l t ,   i m p l e m e n t   o n e   o r   m o r e   o f   t h e s e   e x t e n s i o n   p o i n t s :   I m a g e L o c a l i t y :   F a v o r s   n o d e s   t h a t   a l r e a d y   h a v e   t h e   c o n t a i n e r   i m a g e s   t h a t   t h e   P o d   r u n s .   E x t e n s i o n   p o i n t s :   s c o r e . T a i n t T o l e r a t i o n :   I m p l e m e n t s   t a i n t s   a n d   t o l e r a t i o n s .   I m p l e m e n t s   e x t e n s i o n   p o i n t s :   f i l t e r ,   p r e S c o r e ,   s c o r e . N o d e N a m e :   C h e c k s   i f   a   P o d   s p e c   n o d e   n a m e   m a t c h e s   t h e   c u r r e n t   n o d e .   E x t e n s i o n   p o i n t s :   f i l t e r . N o d e P o r t s :   C h e c k s   i f   a   n o d e   h a s   f r e e   p o r t s   f o r   t h e   r e q u e s t e d   P o d   p o r t s .   E x t e n s i o n   p o i n t s :   p r e F i l t e r ,   f i l t e r . N o d e A f f i n i t y :   I m p l e m e n t s   n o d e   s e l e c t o r s   a n d   n o d e   a f f i n i t y .   E x t e n s i o n   p o i n t s :   f i l t e r ,   s c o r e . P o d T o p o l o g y S p r e a d :   I m p l e m e n t s   P o d   t o p o l o g y   s p r e a d .   E x t e n s i o n   p o i n t s :   p r e F i l t e r ,   f i l t e r ,   p r e S c o r e ,   s c o r e . N o d e U n s c h e d u l a b l e :   F i l t e r s   o u t   n o d e s   t h a t   h a v e   . s p e c . u n s c h e d u l a b l e   s e t   t o   t r u e .   E x t e n s i o n   p o i n t s :   f i l t e r . N o d e R e s o u r c e s F i t :   C h e c k s   i f   t h e   n o d e   h a s   a l l   t h e   r e s o u r c e s   t h a t   t h e   P o d   i s   r e q u e s t i n g .   T h e   s c o r e   c a n   u s e   o n e   o f   t h r e e   s t r a t e g i e s :   L e a s t A l l o c a t e d   ( d e f a u l t ) ,   M o s t A l l o c a t e d   a n d   R e q u e s t e d T o C a p a c i t y


Question: What is Note:?

Answer: Y o u   c a n   a l s o   e n a b l e   t h e   f o l l o w i n g   p l u g i n s ,   t h r o u g h   t h e   c o m p o n e n t   c o n f i g   A P I s ,   t h a t   a r e   n o t   e n a b l e d   b y   d e f a u l t :   C i n d e r L i m i t s :   C h e c k s   t h a t   O p e n S t a c k   C i n d e r   v o l u m e   l i m i t s   c a n   b e   s a t i s f i e d   f o r   t h e   n o d e .   E x t e n s i o n   p o i n t s :   f i l t e r .


Question: What is Multiple profiles?

Answer: Y o u   c a n   c o n f i g u r e   k u b e - s c h e d u l e r   t o   r u n   m o r e   t h a n   o n e   p r o f i l e .   E a c h   p r o f i l e   h a s   a n   a s s o c i a t e d   s c h e d u l e r   n a m e   a n d   c a n   h a v e   a   d i f f e r e n t   s e t   o f   p l u g i n s   c o n f i g u r e d   i n   i t s   e x t e n s i o n   p o i n t s .   W i t h   t h e   f o l l o w i n g   s a m p l e   c o n f i g u r a t i o n ,   t h e   s c h e d u l e r   w i l l   r u n   w i t h   t w o   p r o f i l e s :   o n e   w i t h   t h e   d e f a u l t   p l u g i n s   a n d   o n e   w i t h   a l l   s c o r i n g   p l u g i n s   d i s a b l e d .   a p i V e r s i o n :   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1   k i n d :   K u b e S c h e d u l e r C o n f i g u r a t i o n   p r o f i l e s :   -   s c h e d u l e r N a m e :   d e f a u l t - s c h e d u l e r   -   s c h e d u l e r N a m e :   n o - s c o r i n g - s c h e d u l e r   p l u g i n s :   p r e S c o r e :   d i s a b l e d :   -   n a m e :   ' * '   s c o r e :   d i s a b l e d :   -   n a m e :   ' * '   P o d s   t h a t   w a n t   t o   b e   s c h e d u l e d   a c c o r d i n g   t o   a   s p e c i f i c   p r o f i l e   c a n   i n c l u d e   t h e   c o r r e s p o n d i n g   s c h e d u l e r   n a m e   i n   i t s   . s p e c . s c h e d u l e r N a m e .   B y   d e f a u l t ,   o n e   p r o f i l e   w i t h   t h e   s c h e d u l e r   n a m e   d e f a u l t - s c h e d u l e r   i s   c r e a t e d .   T h i s   p r o f i l e   i n c l u d e s   t h e   d e f a u l t   p l u g i n s   d e s c r i b e d   a b o v e .   W h e n   d e c l a r i n g   m o r e   t h a n   o n e   p r o f i l e ,   a   u n i q u e   s c h e d u l e r   n a m e   f o r   e a c h   o f   t h e m   i s   r e q u i r e d .   I f   a   P o d   d o e s n ' t   s p e c i f y   a   s c h e d u l e r   n a m e ,   k u b e - a p i s e r v e r   w i l l   s e t


Question: What is Note:?

Answer: P o d ' s   s c h e d u l i n g   e v e n t s   h a v e   . s p e c . s c h e d u l e r N a m e   a s   t h e i r   r e p o r t i n g C o n t r o l l e r .   E v e n t s   f o r   l e a d e r   e l e c t i o n   u s e   t h e   s c h e d u l e r   n a m e   o f   t h e   f i r s t   p r o f i l e   i n   t h e   l i s t .   F o r   m o r e   i n f o r m a t i o n ,   p l e a s e   r e f e r   t o   t h e   r e p o r t i n g C o n t r o l l e r   s e c t i o n   u n d e r   E v e n t   A P I   R e f e r e n c e .


Question: What is Plugins that apply to multiple extension points?

Answer: S t a r t i n g   f r o m   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1 b e t a 3 ,   t h e r e   i s   a n   a d d i t i o n a l   f i e l d   i n   t h e   p r o f i l e   c o n f i g ,   m u l t i P o i n t ,   w h i c h   a l l o w s   f o r   e a s i l y   e n a b l i n g   o r   d i s a b l i n g   a   p l u g i n   a c r o s s   s e v e r a l   e x t e n s i o n   p o i n t s .   T h e   i n t e n t   o f   m u l t i P o i n t   c o n f i g   i s   t o   s i m p l i f y   t h e   c o n f i g u r a t i o n   n e e d e d   f o r   u s e r s   a n d   a d m i n i s t r a t o r s   w h e n   u s i n g   c u s t o m   p r o f i l e s .   C o n s i d e r   a   p l u g i n ,   M y P l u g i n ,   w h i c h   i m p l e m e n t s   t h e   p r e S c o r e ,   s c o r e ,   p r e F i l t e r ,   a n d   f i l t e r   e x t e n s i o n   p o i n t s .   T o   e n a b l e   M y P l u g i n   f o r   a l l   i t s   a v a i l a b l e   e x t e n s i o n   p o i n t s ,   t h e   p r o f i l e   c o n f i g   l o o k s   l i k e :   a p i V e r s i o n :   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1   k i n d :   K u b e S c h e d u l e r C o n f i g u r a t i o n   p r o f i l e s :   -   s c h e d u l e r N a m e :   m u l t i p o i n t - s c h e d u l e r   p l u g i n s :   m u l t i P o i n t :   e n a b l e d :   -   n a m e :   M y P l u g i n   T h i s   w o u l d   e q u a t e   t o   m a n u a l l y   e n a b l i n g   M y P l u g i n   f o r   a l l   o f   i t s   e x t e n s i o n   p o i n t s ,   l i k e   s o :   a p i V e r s i o n :   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1   k i n d :   K u b e S c h e d u l e r C o n f i g u r a t i o n   p r o f i l e s :   -   s c h e d u l e r N a m e :   n o n - m u l t i p o i n t - s c h e d u l e r   p l u g i n s :   p r e S c o r e :   e n a b l e d :   -   n a m e :   M y P l u g i n   s c o r e :   e n a b l e d :   -   n a m e :   M y P l u g i n   p r e F


Question: What is Scheduler configuration migrations?

Answer: W i t h   t h e   v 1 b e t a 2   c o n f i g u r a t i o n   v e r s i o n ,   y o u   c a n   u s e   a   n e w   s c o r e   e x t e n s i o n   f o r   t h e   N o d e R e s o u r c e s F i t   p l u g i n .   T h e   n e w   e x t e n s i o n   c o m b i n e s   t h e   f u n c t i o n a l i t i e s   o f   t h e   N o d e R e s o u r c e s L e a s t A l l o c a t e d ,   N o d e R e s o u r c e s M o s t A l l o c a t e d   a n d   R e q u e s t e d T o C a p a c i t y R a t i o   p l u g i n s .   F o r   e x a m p l e ,   i f   y o u   p r e v i o u s l y   u s e d   t h e   N o d e R e s o u r c e s M o s t A l l o c a t e d   p l u g i n ,   y o u   w o u l d   i n s t e a d   u s e   N o d e R e s o u r c e s F i t   ( e n a b l e d   b y   d e f a u l t )   a n d   a d d   a   p l u g i n C o n f i g   w i t h   a   s c o r e S t r a t e g y   t h a t   i s   s i m i l a r   t o : a p i V e r s i o n :   k u b e s c h e d u l e r . c o n f i g . k 8 s . i o / v 1 b e t a 2   k i n d :   K u b e S c h e d u l e r C o n f i g u r a t i o n   p r o f i l e s :   -   p l u g i n C o n f i g :   -   a r g s :   s c o r i n g S t r a t e g y :   r e s o u r c e s :   -   n a m e :   c p u   w e i g h t :   1   t y p e :   M o s t A l l o c a t e d   n a m e :   N o d e R e s o u r c e s F i t   T h e   s c h e d u l e r   p l u g i n   N o d e L a b e l   i s   d e p r e c a t e d ;   i n s t e a d ,   u s e   t h e   N o d e A f f i n i t y   p l u g i n   ( e n a b l e d   b y   d e f a u l t )   t o   a c h i e v e   s i m i l a r   b e h a v i o r . T h e   s c h e d u l e r   p l u g i n   S e r v i c e A f f i n i t y   i s   d e p r e c a t e d ;   i n s t e a d ,   u s e   t h e   I n t e r P o d A f f i n i t y   p l u g i n   ( e n a b l e d   b y   d e f a u l t )   t o   a c h i e v e   s i m i l a r   b e h a v i o r . T h e   s c h e d u l e r   p l u g i n   N o d e P r e f e r A v o i d P o d s   i s   d e p r e c a t e d ;   i n s t e a d ,


Question: What is What's next?

Answer: R e a d   t h e   k u b e - s c h e d u l e r   r e f e r e n c e L e a r n   a b o u t   s c h e d u l i n g R e a d   t h e   k u b e - s c h e d u l e r   c o n f i g u r a t i o n   ( v 1 )   r e f e r e n c e


Question: What is Connecting Applications with Services?

Answer: Connecting Applications with ServicesThe Kubernetes model for connecting containersNow that you have a continuously running, replicated application you can expose it on a network.Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. Kubernetes gives every pod its own cluster-private IP address, so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document elaborates on how you can run reliable services on such a networking model.This tutorial uses a simple nginx web server to demonstrate the concept.Exposing pods to the clusterWe did this in a previous example, but let's do it once again and focus on the networking perspective. Create an nginx Pod, and note that it has a container port specification:service/networking/run-my-nginx.yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx spec: selector: matchLabels: run: my-nginx replicas: 2 template: metadata: labels: run: my-nginx spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80 This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:kubectl apply -f ./run-my-nginx.yaml kubectl get pods -l run=my-nginx -o wide NAME READY STATUS RESTARTS AGE IP NODE my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd Check your pods' IPs:kubectl get pods -l run=my-nginx -o custom-columns=POD_IP:.status.podIPs POD_IP [map[ip:10.244.3.4]] [map[ip:10.244.2.5]] You should be able to ssh into any node in your cluster and use a tool such as curl to make queries against both IPs. Note that the containers are not using port 80 on the node, nor are there any special NAT rules to route traffic to the pod. This means you can run multiple nginx pods on the same node all using the same containerPort, and access them from any other pod or node in your cluster using the assigned IP address for the pod. If you want to arrange for a specific port on the host Node to be forwarded to backing Pods, you can - but the networking model should mean that you do not need to do so.You can read more about the Kubernetes Networking Model if you're curious.Creating a ServiceSo we have pods running nginx in a flat, cluster wide, address space. In theory, you could talk to these pods directly, but what happens when a node dies? The pods die with it, and the ReplicaSet inside the Deployment will create new ones, with different IPs. This is the problem a Service solves.A Kubernetes Service is an abstraction which defines a logical set of Pods running somewhere in your cluster, that all provide the same functionality. When created, each Service is assigned a unique IP address (also called clusterIP). This address is tied to


Question: How does Connecting Applications with Services work?

Answer: Connecting Applications with ServicesThe Kubernetes model for connecting containersNow that you have a continuously running, replicated application you can expose it on a network.Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. Kubernetes gives every pod its own cluster-private IP address, so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document elaborates on how you can run reliable services on such a networking model.This tutorial uses a simple nginx web server to demonstrate the concept.Exposing pods to the clusterWe did this in a previous example, but let's do it once again and focus on the networking perspective. Create an nginx Pod, and note that it has a container port specification:service/networking/run-my-nginx.yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx spec: selector: matchLabels: run: my-nginx replicas: 2 template: metadata: labels: run: my-nginx spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80 This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:kubectl apply -f ./run-my-nginx.yaml kubectl get pods -l run=my-nginx -o wide NAME READY STATUS RESTARTS AGE IP NODE my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd Check your pods' IPs:kubectl get pods -l run=my-nginx -o custom-columns=POD_IP:.status.podIPs POD_IP [map[ip:10.244.3.4]] [map[ip:10.244.2.5]] You should be able to ssh into any node in your cluster and use a tool such as curl to make queries against both IPs. Note that the containers are not using port 80 on the node, nor are there any special NAT rules to route traffic to the pod. This means you can run multiple nginx pods on the same node all using the same containerPort, and access them from any other pod or node in your cluster using the assigned IP address for the pod. If you want to arrange for a specific port on the host Node to be forwarded to backing Pods, you can - but the networking model should mean that you do not need to do so.You can read more about the Kubernetes Networking Model if you're curious.Creating a ServiceSo we have pods running nginx in a flat, cluster wide, address space. In theory, you could talk to these pods directly, but what happens when a node dies? The pods die with it, and the ReplicaSet inside the Deployment will create new ones, with different IPs. This is the problem a Service solves.A Kubernetes Service is an abstraction which defines a logical set of Pods running somewhere in your cluster, that all provide the same functionality. When created, each Service is assigned a unique IP address (also called clusterIP). This address is tied to


Question: When would you use Connecting Applications with Services?

Answer: Connecting Applications with ServicesThe Kubernetes model for connecting containersNow that you have a continuously running, replicated application you can expose it on a network.Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. Kubernetes gives every pod its own cluster-private IP address, so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document elaborates on how you can run reliable services on such a networking model.This tutorial uses a simple nginx web server to demonstrate the concept.Exposing pods to the clusterWe did this in a previous example, but let's do it once again and focus on the networking perspective. Create an nginx Pod, and note that it has a container port specification:service/networking/run-my-nginx.yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx spec: selector: matchLabels: run: my-nginx replicas: 2 template: metadata: labels: run: my-nginx spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80 This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:kubectl apply -f ./run-my-nginx.yaml kubectl get pods -l run=my-nginx -o wide NAME READY STATUS RESTARTS AGE IP NODE my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd Check your pods' IPs:kubectl get pods -l run=my-nginx -o custom-columns=POD_IP:.status.podIPs POD_IP [map[ip:10.244.3.4]] [map[ip:10.244.2.5]] You should be able to ssh into any node in your cluster and use a tool such as curl to make queries against both IPs. Note that the containers are not using port 80 on the node, nor are there any special NAT rules to route traffic to the pod. This means you can run multiple nginx pods on the same node all using the same containerPort, and access them from any other pod or node in your cluster using the assigned IP address for the pod. If you want to arrange for a specific port on the host Node to be forwarded to backing Pods, you can - but the networking model should mean that you do not need to do so.You can read more about the Kubernetes Networking Model if you're curious.Creating a ServiceSo we have pods running nginx in a flat, cluster wide, address space. In theory, you could talk to these pods directly, but what happens when a node dies? The pods die with it, and the ReplicaSet inside the Deployment will create new ones, with different IPs. This is the problem a Service solves.A Kubernetes Service is an abstraction which defines a logical set of Pods running somewhere in your cluster, that all provide the same functionality. When created, each Service is assigned a unique IP address (also called clusterIP). This address is tied to


Question: What are the benefits of Connecting Applications with Services?

Answer: Connecting Applications with ServicesThe Kubernetes model for connecting containersNow that you have a continuously running, replicated application you can expose it on a network.Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. Kubernetes gives every pod its own cluster-private IP address, so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document elaborates on how you can run reliable services on such a networking model.This tutorial uses a simple nginx web server to demonstrate the concept.Exposing pods to the clusterWe did this in a previous example, but let's do it once again and focus on the networking perspective. Create an nginx Pod, and note that it has a container port specification:service/networking/run-my-nginx.yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx spec: selector: matchLabels: run: my-nginx replicas: 2 template: metadata: labels: run: my-nginx spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80 This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:kubectl apply -f ./run-my-nginx.yaml kubectl get pods -l run=my-nginx -o wide NAME READY STATUS RESTARTS AGE IP NODE my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd Check your pods' IPs:kubectl get pods -l run=my-nginx -o custom-columns=POD_IP:.status.podIPs POD_IP [map[ip:10.244.3.4]] [map[ip:10.244.2.5]] You should be able to ssh into any node in your cluster and use a tool such as curl to make queries against both IPs. Note that the containers are not using port 80 on the node, nor are there any special NAT rules to route traffic to the pod. This means you can run multiple nginx pods on the same node all using the same containerPort, and access them from any other pod or node in your cluster using the assigned IP address for the pod. If you want to arrange for a specific port on the host Node to be forwarded to backing Pods, you can - but the networking model should mean that you do not need to do so.You can read more about the Kubernetes Networking Model if you're curious.Creating a ServiceSo we have pods running nginx in a flat, cluster wide, address space. In theory, you could talk to these pods directly, but what happens when a node dies? The pods die with it, and the ReplicaSet inside the Deployment will create new ones, with different IPs. This is the problem a Service solves.A Kubernetes Service is an abstraction which defines a logical set of Pods running somewhere in your cluster, that all provide the same functionality. When created, each Service is assigned a unique IP address (also called clusterIP). This address is tied to


Question: What is The Kubernetes model for connecting containers?

Answer: N o w   t h a t   y o u   h a v e   a   c o n t i n u o u s l y   r u n n i n g ,   r e p l i c a t e d   a p p l i c a t i o n   y o u   c a n   e x p o s e   i t   o n   a   n e t w o r k .   K u b e r n e t e s   a s s u m e s   t h a t   p o d s   c a n   c o m m u n i c a t e   w i t h   o t h e r   p o d s ,   r e g a r d l e s s   o f   w h i c h   h o s t   t h e y   l a n d   o n .   K u b e r n e t e s   g i v e s   e v e r y   p o d   i t s   o w n   c l u s t e r - p r i v a t e   I P   a d d r e s s ,   s o   y o u   d o   n o t   n e e d   t o   e x p l i c i t l y   c r e a t e   l i n k s   b e t w e e n   p o d s   o r   m a p   c o n t a i n e r   p o r t s   t o   h o s t   p o r t s .   T h i s   m e a n s   t h a t   c o n t a i n e r s   w i t h i n   a   P o d   c a n   a l l   r e a c h   e a c h   o t h e r ' s   p o r t s   o n   l o c a l h o s t ,   a n d   a l l   p o d s   i n   a   c l u s t e r   c a n   s e e   e a c h   o t h e r   w i t h o u t   N A T .   T h e   r e s t   o f   t h i s   d o c u m e n t   e l a b o r a t e s   o n   h o w   y o u   c a n   r u n   r e l i a b l e   s e r v i c e s   o n   s u c h   a   n e t w o r k i n g   m o d e l .   T h i s   t u t o r i a l   u s e s   a   s i m p l e   n g i n x   w e b   s e r v e r   t o   d e m o n s t r a t e   t h e   c o n c e p t .


Question: What is Exposing pods to the cluster?

Answer: W e   d i d   t h i s   i n   a   p r e v i o u s   e x a m p l e ,   b u t   l e t ' s   d o   i t   o n c e   a g a i n   a n d   f o c u s   o n   t h e   n e t w o r k i n g   p e r s p e c t i v e .   C r e a t e   a n   n g i n x   P o d ,   a n d   n o t e   t h a t   i t   h a s   a   c o n t a i n e r   p o r t   s p e c i f i c a t i o n :   a p i V e r s i o n :   a p p s / v 1   k i n d :   D e p l o y m e n t   m e t a d a t a :   n a m e :   m y - n g i n x   s p e c :   s e l e c t o r :   m a t c h L a b e l s :   r u n :   m y - n g i n x   r e p l i c a s :   2   t e m p l a t e :   m e t a d a t a :   l a b e l s :   r u n :   m y - n g i n x   s p e c :   c o n t a i n e r s :   -   n a m e :   m y - n g i n x   i m a g e :   n g i n x   p o r t s :   -   c o n t a i n e r P o r t :   8 0   T h i s   m a k e s   i t   a c c e s s i b l e   f r o m   a n y   n o d e   i n   y o u r   c l u s t e r .   C h e c k   t h e   n o d e s   t h e   P o d   i s   r u n n i n g   o n :   k u b e c t l   a p p l y   - f   . / r u n - m y - n g i n x . y a m l   k u b e c t l   g e t   p o d s   - l   r u n = m y - n g i n x   - o   w i d e   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   I P   N O D E   m y - n g i n x - 3 8 0 0 8 5 8 1 8 2 - j r 4 a 2   1 / 1   R u n n i n g   0   1 3 s   1 0 . 2 4 4 . 3 . 4   k u b e r n e t e s - m i n i o n - 9 0 5 m   m y - n g i n x - 3 8 0 0 8 5 8 1 8 2 - k n a 2 y   1 / 1   R u n n i n g   0   1 3 s   1 0 . 2 4 4 . 2 . 5   k u b e r n e t e s - m i n i o n - l j y d   C h e c k   y o u r   p o d s '   I P s :   k u b e c t l   g e t   p o d s   - l   r u n = m y - n g i n x   - o   c u s t o m - c o l u m n s = P O D _ I P : . s t a t u s . p o d I P s   P O D _ I P   [ m a p [ i p : 1 0 . 2 4 4 . 3 . 4 ] ]   [ m a p [ i p : 1 0 . 2 4 4 . 2 . 5 ] ]   Y o u   s h o u l d   b e   a b l e   t o   s s h   i n t o   a n y   n o d e   i n   y o u r   c l u s t e r   a n d   u s e   a   t o o l   s u c h   a


Question: What is Creating a Service?

Answer: S o   w e   h a v e   p o d s   r u n n i n g   n g i n x   i n   a   f l a t ,   c l u s t e r   w i d e ,   a d d r e s s   s p a c e .   I n   t h e o r y ,   y o u   c o u l d   t a l k   t o   t h e s e   p o d s   d i r e c t l y ,   b u t   w h a t   h a p p e n s   w h e n   a   n o d e   d i e s ?   T h e   p o d s   d i e   w i t h   i t ,   a n d   t h e   R e p l i c a S e t   i n s i d e   t h e   D e p l o y m e n t   w i l l   c r e a t e   n e w   o n e s ,   w i t h   d i f f e r e n t   I P s .   T h i s   i s   t h e   p r o b l e m   a   S e r v i c e   s o l v e s .   A   K u b e r n e t e s   S e r v i c e   i s   a n   a b s t r a c t i o n   w h i c h   d e f i n e s   a   l o g i c a l   s e t   o f   P o d s   r u n n i n g   s o m e w h e r e   i n   y o u r   c l u s t e r ,   t h a t   a l l   p r o v i d e   t h e   s a m e   f u n c t i o n a l i t y .   W h e n   c r e a t e d ,   e a c h   S e r v i c e   i s   a s s i g n e d   a   u n i q u e   I P   a d d r e s s   ( a l s o   c a l l e d   c l u s t e r I P ) .   T h i s   a d d r e s s   i s   t i e d   t o   t h e   l i f e s p a n   o f   t h e   S e r v i c e ,   a n d   w i l l   n o t   c h a n g e   w h i l e   t h e   S e r v i c e   i s   a l i v e .   P o d s   c a n   b e   c o n f i g u r e d   t o   t a l k   t o   t h e   S e r v i c e ,   a n d   k n o w   t h a t   c o m m u n i c a t i o n   t o   t h e   S e r v i c e   w i l l   b e   a u t o m a t i c a l l y   l o a d - b a l a n c e d   o u t   t o   s o m e   p o d   t h a t   i s   a   m e m b e r   o f   t h e   S e r v i c e .   Y o u   c a n   c r e a t e   a   S e r v i c e   f o r   y o u r   2   n g i n x   r e p l i c a s   w i t h   k u b e c t l   e x p o s e :   k u b e c t l   e x p o s e   d e p l o y m e n t / m y - n g i n x   s e r v i c e / m y - n g i n x   e x p o s e d   T h i s   i s   e q u i v a l e n t   t o   k u b e c t l   a p p l y   - f   i n   t h e   f o l l o w i n g   y a m


Question: What is Accessing the Service?

Answer: K u b e r n e t e s   s u p p o r t s   2   p r i m a r y   m o d e s   o f   f i n d i n g   a   S e r v i c e   -   e n v i r o n m e n t   v a r i a b l e s   a n d   D N S .   T h e   f o r m e r   w o r k s   o u t   o f   t h e   b o x   w h i l e   t h e   l a t t e r   r e q u i r e s   t h e   C o r e D N S   c l u s t e r   a d d o n .


Question: What is Environment Variables?

Answer: W h e n   a   P o d   r u n s   o n   a   N o d e ,   t h e   k u b e l e t   a d d s   a   s e t   o f   e n v i r o n m e n t   v a r i a b l e s   f o r   e a c h   a c t i v e   S e r v i c e .   T h i s   i n t r o d u c e s   a n   o r d e r i n g   p r o b l e m .   T o   s e e   w h y ,   i n s p e c t   t h e   e n v i r o n m e n t   o f   y o u r   r u n n i n g   n g i n x   P o d s   ( y o u r   P o d   n a m e   w i l l   b e   d i f f e r e n t ) :   k u b e c t l   e x e c   m y - n g i n x - 3 8 0 0 8 5 8 1 8 2 - j r 4 a 2   - -   p r i n t e n v   |   g r e p   S E R V I C E   K U B E R N E T E S _ S E R V I C E _ H O S T = 1 0 . 0 . 0 . 1   K U B E R N E T E S _ S E R V I C E _ P O R T = 4 4 3   K U B E R N E T E S _ S E R V I C E _ P O R T _ H T T P S = 4 4 3   N o t e   t h e r e ' s   n o   m e n t i o n   o f   y o u r   S e r v i c e .   T h i s   i s   b e c a u s e   y o u   c r e a t e d   t h e   r e p l i c a s   b e f o r e   t h e   S e r v i c e .   A n o t h e r   d i s a d v a n t a g e   o f   d o i n g   t h i s   i s   t h a t   t h e   s c h e d u l e r   m i g h t   p u t   b o t h   P o d s   o n   t h e   s a m e   m a c h i n e ,   w h i c h   w i l l   t a k e   y o u r   e n t i r e   S e r v i c e   d o w n   i f   i t   d i e s .   W e   c a n   d o   t h i s   t h e   r i g h t   w a y   b y   k i l l i n g   t h e   2   P o d s   a n d   w a i t i n g   f o r   t h e   D e p l o y m e n t   t o   r e c r e a t e   t h e m .   T h i s   t i m e   t h e   S e r v i c e   e x i s t s   b e f o r e   t h e   r e p l i c a s .   T h i s   w i l l   g i v e   y o u   s c h e d u l e r - l e v e l   S e r v i c e   s p r e a d i n g   o f   y o u r   P o d s   ( p r o v i d e d   a l l   y o u r   n o d e s   h a v e   e q u a l   c a p a c i t y ) ,   a s   w e l l   a s   t h e   r i g h t   e n v i r o n m e n t   v a r i a b l e s :   k u b e c t l   s c a l e   d e p l o y m e n t   m y - n g i n x   - - r e p l i c a s


Question: What is DNS?

Answer: K u b e r n e t e s   o f f e r s   a   D N S   c l u s t e r   a d d o n   S e r v i c e   t h a t   a u t o m a t i c a l l y   a s s i g n s   d n s   n a m e s   t o   o t h e r   S e r v i c e s .   Y o u   c a n   c h e c k   i f   i t ' s   r u n n i n g   o n   y o u r   c l u s t e r :   k u b e c t l   g e t   s e r v i c e s   k u b e - d n s   - - n a m e s p a c e = k u b e - s y s t e m   N A M E   T Y P E   C L U S T E R - I P   E X T E R N A L - I P   P O R T ( S )   A G E   k u b e - d n s   C l u s t e r I P   1 0 . 0 . 0 . 1 0   < n o n e >   5 3 / U D P , 5 3 / T C P   8 m   T h e   r e s t   o f   t h i s   s e c t i o n   w i l l   a s s u m e   y o u   h a v e   a   S e r v i c e   w i t h   a   l o n g   l i v e d   I P   ( m y - n g i n x ) ,   a n d   a   D N S   s e r v e r   t h a t   h a s   a s s i g n e d   a   n a m e   t o   t h a t   I P .   H e r e   w e   u s e   t h e   C o r e D N S   c l u s t e r   a d d o n   ( a p p l i c a t i o n   n a m e   k u b e - d n s ) ,   s o   y o u   c a n   t a l k   t o   t h e   S e r v i c e   f r o m   a n y   p o d   i n   y o u r   c l u s t e r   u s i n g   s t a n d a r d   m e t h o d s   ( e . g .   g e t h o s t b y n a m e ( ) ) .   I f   C o r e D N S   i s n ' t   r u n n i n g ,   y o u   c a n   e n a b l e   i t   r e f e r r i n g   t o   t h e   C o r e D N S   R E A D M E   o r   I n s t a l l i n g   C o r e D N S .   L e t ' s   r u n   a n o t h e r   c u r l   a p p l i c a t i o n   t o   t e s t   t h i s :   k u b e c t l   r u n   c u r l   - - i m a g e = r a d i a l / b u s y b o x p l u s : c u r l   - i   - - t t y   - - r m   W a i t i n g   f o r   p o d   d e f a u l t / c u r l - 1 3 1 5 5 6 2 1 8 - 9 f n c h   t o   b e   r u n n i n g ,   s t a t u s   i s   P e n d i n g ,   p o d   r e a d y :   f a l s e   H i t   e n t e r   f o r   c o m m a n d   p r o m p t   T h e n ,   h i t   e n t e r   a n d   r u n   n s l o o k u p   m y - n g i n x :   [   r


Question: What is Securing the Service?

Answer: T i l l   n o w   w e   h a v e   o n l y   a c c e s s e d   t h e   n g i n x   s e r v e r   f r o m   w i t h i n   t h e   c l u s t e r .   B e f o r e   e x p o s i n g   t h e   S e r v i c e   t o   t h e   i n t e r n e t ,   y o u   w a n t   t o   m a k e   s u r e   t h e   c o m m u n i c a t i o n   c h a n n e l   i s   s e c u r e .   F o r   t h i s ,   y o u   w i l l   n e e d :   S e l f   s i g n e d   c e r t i f i c a t e s   f o r   h t t p s   ( u n l e s s   y o u   a l r e a d y   h a v e   a n   i d e n t i t y   c e r t i f i c a t e ) A n   n g i n x   s e r v e r   c o n f i g u r e d   t o   u s e   t h e   c e r t i f i c a t e s A   s e c r e t   t h a t   m a k e s   t h e   c e r t i f i c a t e s   a c c e s s i b l e   t o   p o d s   Y o u   c a n   a c q u i r e   a l l   t h e s e   f r o m   t h e   n g i n x   h t t p s   e x a m p l e .   T h i s   r e q u i r e s   h a v i n g   g o   a n d   m a k e   t o o l s   i n s t a l l e d .   I f   y o u   d o n ' t   w a n t   t o   i n s t a l l   t h o s e ,   t h e n   f o l l o w   t h e   m a n u a l   s t e p s   l a t e r .   I n   s h o r t :   m a k e   k e y s   K E Y = / t m p / n g i n x . k e y   C E R T = / t m p / n g i n x . c r t   k u b e c t l   c r e a t e   s e c r e t   t l s   n g i n x s e c r e t   - - k e y   / t m p / n g i n x . k e y   - - c e r t   / t m p / n g i n x . c r t   s e c r e t / n g i n x s e c r e t   c r e a t e d   k u b e c t l   g e t   s e c r e t s   N A M E   T Y P E   D A T A   A G E   n g i n x s e c r e t   k u b e r n e t e s . i o / t l s   2   1 m   A n d   a l s o   t h e   c o n f i g m a p :   k u b e c t l   c r e a t e   c o n f i g m a p   n g i n x c o n f i g m a p   - - f r o m - f i l e = d e f a u l t . c o n f   Y o u   c a n   f i n d   a n   e x a m p l e   f o r   d e f a u l t . c o n f   i n   t h e   K u b e r n e t e s   e x a m p l e s   p r o j e c t   r e p o .   c o n f i g m a p / n g i n x c o n


Question: What is Exposing the Service?

Answer: F o r   s o m e   p a r t s   o f   y o u r   a p p l i c a t i o n s   y o u   m a y   w a n t   t o   e x p o s e   a   S e r v i c e   o n t o   a n   e x t e r n a l   I P   a d d r e s s .   K u b e r n e t e s   s u p p o r t s   t w o   w a y s   o f   d o i n g   t h i s :   N o d e P o r t s   a n d   L o a d B a l a n c e r s .   T h e   S e r v i c e   c r e a t e d   i n   t h e   l a s t   s e c t i o n   a l r e a d y   u s e d   N o d e P o r t ,   s o   y o u r   n g i n x   H T T P S   r e p l i c a   i s   r e a d y   t o   s e r v e   t r a f f i c   o n   t h e   i n t e r n e t   i f   y o u r   n o d e   h a s   a   p u b l i c   I P .   k u b e c t l   g e t   s v c   m y - n g i n x   - o   y a m l   |   g r e p   n o d e P o r t   - C   5   u i d :   0 7 1 9 1 f b 3 - f 6 1 a - 1 1 e 5 - 8 a e 5 - 4 2 0 1 0 a f 0 0 0 0 2   s p e c :   c l u s t e r I P :   1 0 . 0 . 1 6 2 . 1 4 9   p o r t s :   -   n a m e :   h t t p   n o d e P o r t :   3 1 7 0 4   p o r t :   8 0 8 0   p r o t o c o l :   T C P   t a r g e t P o r t :   8 0   -   n a m e :   h t t p s   n o d e P o r t :   3 2 4 5 3   p o r t :   4 4 3   p r o t o c o l :   T C P   t a r g e t P o r t :   4 4 3   s e l e c t o r :   r u n :   m y - n g i n x   k u b e c t l   g e t   n o d e s   - o   y a m l   |   g r e p   E x t e r n a l I P   - C   1   -   a d d r e s s :   1 0 4 . 1 9 7 . 4 1 . 1 1   t y p e :   E x t e r n a l I P   a l l o c a t a b l e :   - -   -   a d d r e s s :   2 3 . 2 5 1 . 1 5 2 . 5 6   t y p e :   E x t e r n a l I P   a l l o c a t a b l e :   . . .   $   c u r l   h t t p s : / / < E X T E R N A L - I P > : < N O D E - P O R T >   - k   . . .   < h 1 > W e l c o m e   t o   n g i n x ! < / h 1 >   L e t ' s   n o w   r e c r e a t e   t h e   S e r v i c e   t o   u s e   a   c l o u d   l o a d   b a l a n c e r .   C h a n g e   t h e   T y p e   o f   m y - n g i n x   S e r v i c e   f r o m   N o d e P o r t   t o   L o a d B a l a n c e r :   k


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   U s i n g   a   S e r v i c e   t o   A c c e s s   a n   A p p l i c a t i o n   i n   a   C l u s t e r L e a r n   m o r e   a b o u t   C o n n e c t i n g   a   F r o n t   E n d   t o   a   B a c k   E n d   U s i n g   a   S e r v i c e L e a r n   m o r e   a b o u t   C r e a t i n g   a n   E x t e r n a l   L o a d   B a l a n c e r


Question: What is Use Antrea for NetworkPolicy?

Answer: Use Antrea for NetworkPolicyThis page shows how to install and use Antrea CNI plugin on Kubernetes. For background on Project Antrea, read the Introduction to Antrea.Before you beginYou need to have a Kubernetes cluster. Follow the kubeadm getting started guide to bootstrap one.Deploying Antrea with kubeadmFollow Getting Started guide to deploy Antrea for kubeadm.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try out Kubernetes NetworkPolicy.


Question: How does Use Antrea for NetworkPolicy work?

Answer: Use Antrea for NetworkPolicyThis page shows how to install and use Antrea CNI plugin on Kubernetes. For background on Project Antrea, read the Introduction to Antrea.Before you beginYou need to have a Kubernetes cluster. Follow the kubeadm getting started guide to bootstrap one.Deploying Antrea with kubeadmFollow Getting Started guide to deploy Antrea for kubeadm.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try out Kubernetes NetworkPolicy.


Question: When would you use Use Antrea for NetworkPolicy?

Answer: Use Antrea for NetworkPolicyThis page shows how to install and use Antrea CNI plugin on Kubernetes. For background on Project Antrea, read the Introduction to Antrea.Before you beginYou need to have a Kubernetes cluster. Follow the kubeadm getting started guide to bootstrap one.Deploying Antrea with kubeadmFollow Getting Started guide to deploy Antrea for kubeadm.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try out Kubernetes NetworkPolicy.


Question: What are the benefits of Use Antrea for NetworkPolicy?

Answer: Use Antrea for NetworkPolicyThis page shows how to install and use Antrea CNI plugin on Kubernetes. For background on Project Antrea, read the Introduction to Antrea.Before you beginYou need to have a Kubernetes cluster. Follow the kubeadm getting started guide to bootstrap one.Deploying Antrea with kubeadmFollow Getting Started guide to deploy Antrea for kubeadm.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try out Kubernetes NetworkPolicy.


Question: What is Use Antrea for NetworkPolicy?

Answer: T h i s   p a g e   s h o w s   h o w   t o   i n s t a l l   a n d   u s e   A n t r e a   C N I   p l u g i n   o n   K u b e r n e t e s .   F o r   b a c k g r o u n d   o n   P r o j e c t   A n t r e a ,   r e a d   t h e   I n t r o d u c t i o n   t o   A n t r e a .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r .   F o l l o w   t h e   k u b e a d m   g e t t i n g   s t a r t e d   g u i d e   t o   b o o t s t r a p   o n e .


Question: What is Deploying Antrea with kubeadm?

Answer: F o l l o w   G e t t i n g   S t a r t e d   g u i d e   t o   d e p l o y   A n t r e a   f o r   k u b e a d m .


Question: What is What's next?

Answer: O n c e   y o u r   c l u s t e r   i s   r u n n i n g ,   y o u   c a n   f o l l o w   t h e   D e c l a r e   N e t w o r k   P o l i c y   t o   t r y   o u t   K u b e r n e t e s   N e t w o r k P o l i c y .


Question: What is TypedLocalObjectReference?

Answer: TypedLocalObjectReferenceTypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.import "k8s.io/api/core/v1"TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.kind (string), requiredKind is the type of resource being referencedname (string), requiredName is the name of resource being referencedapiGroup (string)APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does TypedLocalObjectReference work?

Answer: TypedLocalObjectReferenceTypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.import "k8s.io/api/core/v1"TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.kind (string), requiredKind is the type of resource being referencedname (string), requiredName is the name of resource being referencedapiGroup (string)APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use TypedLocalObjectReference?

Answer: TypedLocalObjectReferenceTypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.import "k8s.io/api/core/v1"TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.kind (string), requiredKind is the type of resource being referencedname (string), requiredName is the name of resource being referencedapiGroup (string)APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of TypedLocalObjectReference?

Answer: TypedLocalObjectReferenceTypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.import "k8s.io/api/core/v1"TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.kind (string), requiredKind is the type of resource being referencedname (string), requiredName is the name of resource being referencedapiGroup (string)APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is TypedLocalObjectReference?

Answer: i m p o r t   " k 8 s . i o / a p i / c o r e / v 1 "   T y p e d L o c a l O b j e c t R e f e r e n c e   c o n t a i n s   e n o u g h   i n f o r m a t i o n   t o   l e t   y o u   l o c a t e   t h e   t y p e d   r e f e r e n c e d   o b j e c t   i n s i d e   t h e   s a m e   n a m e s p a c e .   k i n d   ( s t r i n g ) ,   r e q u i r e d K i n d   i s   t h e   t y p e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d n a m e   ( s t r i n g ) ,   r e q u i r e d N a m e   i s   t h e   n a m e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d a p i G r o u p   ( s t r i n g ) A P I G r o u p   i s   t h e   g r o u p   f o r   t h e   r e s o u r c e   b e i n g   r e f e r e n c e d .   I f   A P I G r o u p   i s   n o t   s p e c i f i e d ,   t h e   s p e c i f i e d   K i n d   m u s t   b e   i n   t h e   c o r e   A P I   g r o u p .   F o r   a n y   o t h e r   t h i r d - p a r t y   t y p e s ,   A P I G r o u p   i s   r e q u i r e d .   k i n d   ( s t r i n g ) ,   r e q u i r e d   K i n d   i s   t h e   t y p e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d   n a m e   ( s t r i n g ) ,   r e q u i r e d   N a m e   i s   t h e   n a m e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d   a p i G r o u p   ( s t r i n g )   A P I G r o u p   i s   t h e   g r o u p   f o r   t h e   r e s o u r c e   b e i n g   r e f e r e n c e d .   I f   A P I G r o u p   i s   n o t   s p e c i f i e d ,   t h e   s p e c i f i e d   K i n d   m u s t   b e   i n   t h e   c o r e   A P I   g r o u p .   F o r   a n y   o t h e r   t h i r d - p a r t y   t y p e s ,   A P I G r o u p   i s   r e q u i r e d .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n


Question: What is Extend Kubernetes?

Answer: Extend KubernetesUnderstand advanced ways to adapt your Kubernetes cluster to the needs of your work environment.Configure the Aggregation LayerUse Custom ResourcesSet up an Extension API ServerConfigure Multiple SchedulersUse an HTTP Proxy to Access the Kubernetes APIUse a SOCKS5 Proxy to Access the Kubernetes APISet up Konnectivity service


Question: How does Extend Kubernetes work?

Answer: Extend KubernetesUnderstand advanced ways to adapt your Kubernetes cluster to the needs of your work environment.Configure the Aggregation LayerUse Custom ResourcesSet up an Extension API ServerConfigure Multiple SchedulersUse an HTTP Proxy to Access the Kubernetes APIUse a SOCKS5 Proxy to Access the Kubernetes APISet up Konnectivity service


Question: When would you use Extend Kubernetes?

Answer: Extend KubernetesUnderstand advanced ways to adapt your Kubernetes cluster to the needs of your work environment.Configure the Aggregation LayerUse Custom ResourcesSet up an Extension API ServerConfigure Multiple SchedulersUse an HTTP Proxy to Access the Kubernetes APIUse a SOCKS5 Proxy to Access the Kubernetes APISet up Konnectivity service


Question: What are the benefits of Extend Kubernetes?

Answer: Extend KubernetesUnderstand advanced ways to adapt your Kubernetes cluster to the needs of your work environment.Configure the Aggregation LayerUse Custom ResourcesSet up an Extension API ServerConfigure Multiple SchedulersUse an HTTP Proxy to Access the Kubernetes APIUse a SOCKS5 Proxy to Access the Kubernetes APISet up Konnectivity service


Question: What is Client Authentication (v1beta1)?

Answer: Client Authentication (v1beta1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1beta1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec


Question: How does Client Authentication (v1beta1) work?

Answer: Client Authentication (v1beta1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1beta1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec


Question: When would you use Client Authentication (v1beta1)?

Answer: Client Authentication (v1beta1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1beta1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec


Question: What are the benefits of Client Authentication (v1beta1)?

Answer: Client Authentication (v1beta1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1beta1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec


Question: What is Resource Types?

Answer: E x e c C r e d e n t i a l


Question: What is ExecCredential?

Answer: E x e c C r e d e n t i a l   i s   u s e d   b y   e x e c - b a s e d   p l u g i n s   t o   c o m m u n i c a t e   c r e d e n t i a l s   t o   H T T P   t r a n s p o r t s .   S p e c   h o l d s   i n f o r m a t i o n   p a s s e d   t o   t h e   p l u g i n   b y   t h e   t r a n s p o r t .   S t a t u s   i s   f i l l e d   i n   b y   t h e   p l u g i n   a n d   h o l d s   t h e   c r e d e n t i a l s   t h a t   t h e   t r a n s p o r t   s h o u l d   u s e   t o   c o n t a c t   t h e   A P I .


Question: What is Cluster?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l S p e c   C l u s t e r   c o n t a i n s   i n f o r m a t i o n   t o   a l l o w   a n   e x e c   p l u g i n   t o   c o m m u n i c a t e   w i t h   t h e   k u b e r n e t e s   c l u s t e r   b e i n g   a u t h e n t i c a t e d   t o .   T o   e n s u r e   t h a t   t h i s   s t r u c t   c o n t a i n s   e v e r y t h i n g   s o m e o n e   w o u l d   n e e d   t o   c o m m u n i c a t e   w i t h   a   k u b e r n e t e s   c l u s t e r   ( j u s t   l i k e   t h e y   w o u l d   v i a   a   k u b e c o n f i g ) ,   t h e   f i e l d s   s h o u l d   s h a d o w   " k 8 s . i o / c l i e n t - g o / t o o l s / c l i e n t c m d / a p i / v 1 " . C l u s t e r ,   w i t h   t h e   e x c e p t i o n   o f   C e r t i f i c a t e A u t h o r i t y ,   s i n c e   C A   d a t a   w i l l   a l w a y s   b e   p a s s e d   t o   t h e   p l u g i n   a s   b y t e s .   S e r v e r   i s   t h e   a d d r e s s   o f   t h e   k u b e r n e t e s   c l u s t e r   ( h t t p s : / / h o s t n a m e : p o r t ) .   T L S S e r v e r N a m e   i s   p a s s e d   t o   t h e   s e r v e r   f o r   S N I   a n d   i s   u s e d   i n   t h e   c l i e n t   t o   c h e c k   s e r v e r   c e r t i f i c a t e s   a g a i n s t .   I f   S e r v e r N a m e   i s   e m p t y ,   t h e   h o s t n a m e   u s e d   t o   c o n t a c t   t h e   s e r v e r   i s   u s e d .   I n s e c u r e S k i p T L S V e r i f y   s k i p s   t h e   v a l i d i t y   c h e c k   f o r   t h e   s e r v e r ' s   c e r t i f i c a t e .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e .   C A D a t a   c o n t a i n s   P E M - e n c o d e d   c e r t i f i c a t e   a u t h o r i t y   c e r t i f i c a t e s .   I f   e m p t y ,   s y s t e m   r o o t s   s h o u l d   b e   u s e d .   P r o x y U R L   i s   t h e   U R L   t o   t h e   p r o x y   t o   b


Question: What is ExecCredentialSpec?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l   E x e c C r e d e n t i a l S p e c   h o l d s   r e q u e s t   a n d   r u n t i m e   s p e c i f i c   i n f o r m a t i o n   p r o v i d e d   b y   t h e   t r a n s p o r t .   C l u s t e r   c o n t a i n s   i n f o r m a t i o n   t o   a l l o w   a n   e x e c   p l u g i n   t o   c o m m u n i c a t e   w i t h   t h e   k u b e r n e t e s   c l u s t e r   b e i n g   a u t h e n t i c a t e d   t o .   N o t e   t h a t   C l u s t e r   i s   n o n - n i l   o n l y   w h e n   p r o v i d e C l u s t e r I n f o   i s   s e t   t o   t r u e   i n   t h e   e x e c   p r o v i d e r   c o n f i g   ( i . e . ,   E x e c C o n f i g . P r o v i d e C l u s t e r I n f o ) .   I n t e r a c t i v e   d e c l a r e s   w h e t h e r   s t d i n   h a s   b e e n   p a s s e d   t o   t h i s   e x e c   p l u g i n .


Question: What is ExecCredentialStatus?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l   E x e c C r e d e n t i a l S t a t u s   h o l d s   c r e d e n t i a l s   f o r   t h e   t r a n s p o r t   t o   u s e .   T o k e n   a n d   C l i e n t K e y D a t a   a r e   s e n s i t i v e   f i e l d s .   T h i s   d a t a   s h o u l d   o n l y   b e   t r a n s m i t t e d   i n - m e m o r y   b e t w e e n   c l i e n t   a n d   e x e c   p l u g i n   p r o c e s s .   E x e c   p l u g i n   i t s e l f   s h o u l d   a t   l e a s t   b e   p r o t e c t e d   v i a   f i l e   p e r m i s s i o n s .   E x p i r a t i o n T i m e s t a m p   i n d i c a t e s   a   t i m e   w h e n   t h e   p r o v i d e d   c r e d e n t i a l s   e x p i r e .   T o k e n   i s   a   b e a r e r   t o k e n   u s e d   b y   t h e   c l i e n t   f o r   r e q u e s t   a u t h e n t i c a t i o n .   P E M - e n c o d e d   c l i e n t   T L S   c e r t i f i c a t e s   ( i n c l u d i n g   i n t e r m e d i a t e s ,   i f   a n y ) .   P E M - e n c o d e d   p r i v a t e   k e y   f o r   t h e   a b o v e   c e r t i f i c a t e .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is kubectl config delete-context?

Answer: kubectl config delete-contextSynopsisDelete the specified context from the kubeconfig.kubectl config delete-context NAME Examples # Delete the context for the minikube cluster kubectl config delete-context minikube Options-h, --helphelp for delete-contextParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--vers


Question: How does kubectl config delete-context work?

Answer: kubectl config delete-contextSynopsisDelete the specified context from the kubeconfig.kubectl config delete-context NAME Examples # Delete the context for the minikube cluster kubectl config delete-context minikube Options-h, --helphelp for delete-contextParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--vers


Question: When would you use kubectl config delete-context?

Answer: kubectl config delete-contextSynopsisDelete the specified context from the kubeconfig.kubectl config delete-context NAME Examples # Delete the context for the minikube cluster kubectl config delete-context minikube Options-h, --helphelp for delete-contextParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--vers


Question: What are the benefits of kubectl config delete-context?

Answer: kubectl config delete-contextSynopsisDelete the specified context from the kubeconfig.kubectl config delete-context NAME Examples # Delete the context for the minikube cluster kubectl config delete-context minikube Options-h, --helphelp for delete-contextParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--vers


Question: What is Synopsis?

Answer: D e l e t e   t h e   s p e c i f i e d   c o n t e x t   f r o m   t h e   k u b e c o n f i g .   k u b e c t l   c o n f i g   d e l e t e - c o n t e x t   N A M E


Question: What is Examples?

Answer: #   D e l e t e   t h e   c o n t e x t   f o r   t h e   m i n i k u b e   c l u s t e r   k u b e c t l   c o n f i g   d e l e t e - c o n t e x t   m i n i k u b e


Question: What is Options?

Answer: h e l p   f o r   d e l e t e - c o n t e x t


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   u s e   a   p a r t i c u l a r   k u b e c o n f i g   f i l e   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t i o n   t o   t h e   A P I   s e r v e


Question: What is See Also?

Answer: k u b e c t l   c o n f i g   -   M o d i f y   k u b e c o n f i g   f i l e s   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Leases?

Answer: LeasesDistributed systems often have a need for leases, which provide a mechanism to lock shared resources and coordinate activity between members of a set. In Kubernetes, the lease concept is represented by Lease objects in the coordination.k8s.io API Group, which are used for system-critical capabilities such as node heartbeats and component-level leader election.Node heartbeatsKubernetes uses the Lease API to communicate kubelet node heartbeats to the Kubernetes API server. For every Node , there is a Lease object with a matching name in the kube-node-lease namespace. Under the hood, every kubelet heartbeat is an update request to this Lease object, updating the spec.renewTime field for the Lease. The Kubernetes control plane uses the time stamp of this field to determine the availability of this Node.See Node Lease objects for more details.Leader electionKubernetes also uses Leases to ensure only one instance of a component is running at any given time. This is used by control plane components like kube-controller-manager and kube-scheduler in HA configurations, where only one instance of the component should be actively running while the other instances are on stand-by.Read coordinated leader election to learn about how Kubernetes builds on the Lease API to select which component instance acts as leader.API server identityFEATURE STATE: Kubernetes v1.26 [beta] (enabled by default: true)Starting in Kubernetes v1.26, each kube-apiserver uses the Lease API to publish its identity to the rest of the system. While not particularly useful on its own, this provides a mechanism for clients to discover how many instances of kube-apiserver are operating the Kubernetes control plane. Existence of kube-apiserver leases enables future capabilities that may require coordination between each kube-apiserver.You can inspect Leases owned by each kube-apiserver by checking for lease objects in the kube-system namespace with the name apiserver-<sha256-hash>. Alternatively you can use the label selector apiserver.kubernetes.io/identity=kube-apiserver:kubectl -n kube-system get lease -l apiserver.kubernetes.io/identity=kube-apiserver NAME HOLDER AGE apiserver-07a5ea9b9b072c4a5f3d1c3702 apiserver-07a5ea9b9b072c4a5f3d1c3702_0c8914f7-0f35-440e-8676-7844977d3a05 5m33s apiserver-7be9e061c59d368b3ddaf1376e apiserver-7be9e061c59d368b3ddaf1376e_84f2a85d-37c1-4b14-b6b9-603e62e4896f 4m23s apiserver-1dfef752bcb36637d2763d1868 apiserver-1dfef752bcb36637d2763d1868_c5ffa286-8a9a-45d4-91e7-61118ed58d2e 4m43s The SHA256 hash used in the lease name is based on the OS hostname as seen by that API server. Each kube-apiserver should be configured to use a hostname that is unique within the cluster. New instances of kube-apiserver that use the same hostname will take over existing Leases using a new holder identity, as opposed to instantiating new Lease objects. You can check the hostname used by kube-apiserver by checking the value of the kubernetes.io/hostname label:kubectl -n kube