Question: When would you use Expose Pod Information to Containers Through Environment Variables?

Answer: Expose Pod Information to Containers Through Environment VariablesThis page shows how a Pod can use environment variables to expose information about itself to containers running in the Pod, using the downward API. You can use environment variables to expose Pod fields, container fields, or both.In Kubernetes, there are two ways to expose Pod and container fields to a running container:Environment variables, as explained in this taskVolume filesTogether, these two ways of exposing Pod and container fields are called the downward API.As Services are the primary mode of communication between containerized applications managed by Kubernetes, it is helpful to be able to discover them at runtime.Read more about accessing Services here.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesUse Pod fields as values for environment variablesIn this part of exercise, you create a Pod that has one container, and you project Pod-level fields into the running container as environment variables.pods/inject/dapi-envars-pod.yaml apiVersion: v1 kind: Pod metadata: name: dapi-envars-fieldref spec: containers: - name: test-container image: registry.k8s.io/busybox:1.27.2 command: [ "sh", "-c"] args: - while true; do echo -en '\n'; printenv MY_NODE_NAME MY_POD_NAME MY_POD_NAMESPACE; printenv MY_POD_IP MY_POD_SERVICE_ACCOUNT; sleep 10; done; env: - name: MY_NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: MY_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: MY_POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: MY_POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: MY_POD_SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName restartPolicy: Never In that manifest, you can see five environment variables. The env field is an array of environment variable definitions. The first element in the array specifies that the MY_NODE_NAME environment variable gets its value from the Pod's spec.nodeName field. Similarly, the other environment variables get their names from Pod fields.Note:The fields in this example are Pod fields. They are not fields of the container in the Pod.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/inject/dapi-envars-pod.yaml Verify that the container in the Pod is running:# If the new Pod isn't yet healthy, rerun this command a few times. kubectl get pods View the container's logs:kubectl logs dapi-envars-fieldref The output shows the values of selected environment variables:minikube dapi-envars-fieldref default 172.17.0.4 default To see why these values are in the log, look at the command


Question: What are the benefits of Expose Pod Information to Containers Through Environment Variables?

Answer: Expose Pod Information to Containers Through Environment VariablesThis page shows how a Pod can use environment variables to expose information about itself to containers running in the Pod, using the downward API. You can use environment variables to expose Pod fields, container fields, or both.In Kubernetes, there are two ways to expose Pod and container fields to a running container:Environment variables, as explained in this taskVolume filesTogether, these two ways of exposing Pod and container fields are called the downward API.As Services are the primary mode of communication between containerized applications managed by Kubernetes, it is helpful to be able to discover them at runtime.Read more about accessing Services here.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesUse Pod fields as values for environment variablesIn this part of exercise, you create a Pod that has one container, and you project Pod-level fields into the running container as environment variables.pods/inject/dapi-envars-pod.yaml apiVersion: v1 kind: Pod metadata: name: dapi-envars-fieldref spec: containers: - name: test-container image: registry.k8s.io/busybox:1.27.2 command: [ "sh", "-c"] args: - while true; do echo -en '\n'; printenv MY_NODE_NAME MY_POD_NAME MY_POD_NAMESPACE; printenv MY_POD_IP MY_POD_SERVICE_ACCOUNT; sleep 10; done; env: - name: MY_NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: MY_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: MY_POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: MY_POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: MY_POD_SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName restartPolicy: Never In that manifest, you can see five environment variables. The env field is an array of environment variable definitions. The first element in the array specifies that the MY_NODE_NAME environment variable gets its value from the Pod's spec.nodeName field. Similarly, the other environment variables get their names from Pod fields.Note:The fields in this example are Pod fields. They are not fields of the container in the Pod.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/inject/dapi-envars-pod.yaml Verify that the container in the Pod is running:# If the new Pod isn't yet healthy, rerun this command a few times. kubectl get pods View the container's logs:kubectl logs dapi-envars-fieldref The output shows the values of selected environment variables:minikube dapi-envars-fieldref default 172.17.0.4 default To see why these values are in the log, look at the command


Question: What is Expose Pod Information to Containers Through Environment Variables?

Answer: T h i s   p a g e   s h o w s   h o w   a   P o d   c a n   u s e   e n v i r o n m e n t   v a r i a b l e s   t o   e x p o s e   i n f o r m a t i o n   a b o u t   i t s e l f   t o   c o n t a i n e r s   r u n n i n g   i n   t h e   P o d ,   u s i n g   t h e   d o w n w a r d   A P I .   Y o u   c a n   u s e   e n v i r o n m e n t   v a r i a b l e s   t o   e x p o s e   P o d   f i e l d s ,   c o n t a i n e r   f i e l d s ,   o r   b o t h .   I n   K u b e r n e t e s ,   t h e r e   a r e   t w o   w a y s   t o   e x p o s e   P o d   a n d   c o n t a i n e r   f i e l d s   t o   a   r u n n i n g   c o n t a i n e r :   E n v i r o n m e n t   v a r i a b l e s ,   a s   e x p l a i n e d   i n   t h i s   t a s k V o l u m e   f i l e s   T o g e t h e r ,   t h e s e   t w o   w a y s   o f   e x p o s i n g   P o d   a n d   c o n t a i n e r   f i e l d s   a r e   c a l l e d   t h e   d o w n w a r d   A P I .   A s   S e r v i c e s   a r e   t h e   p r i m a r y   m o d e   o f   c o m m u n i c a t i o n   b e t w e e n   c o n t a i n e r i z e d   a p p l i c a t i o n s   m a n a g e d   b y   K u b e r n e t e s ,   i t   i s   h e l p f u l   t o   b e   a b l e   t o   d i s c o v e r   t h e m   a t   r u n t i m e .   R e a d   m o r e   a b o u t   a c c e s s i n g   S e r v i c e s   h e r e .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s


Question: What is Use Pod fields as values for environment variables?

Answer: I n   t h i s   p a r t   o f   e x e r c i s e ,   y o u   c r e a t e   a   P o d   t h a t   h a s   o n e   c o n t a i n e r ,   a n d   y o u   p r o j e c t   P o d - l e v e l   f i e l d s   i n t o   t h e   r u n n i n g   c o n t a i n e r   a s   e n v i r o n m e n t   v a r i a b l e s .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   d a p i - e n v a r s - f i e l d r e f   s p e c :   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   r e g i s t r y . k 8 s . i o / b u s y b o x : 1 . 2 7 . 2   c o m m a n d :   [   " s h " ,   " - c " ]   a r g s :   -   w h i l e   t r u e ;   d o   e c h o   - e n   ' \ n ' ;   p r i n t e n v   M Y _ N O D E _ N A M E   M Y _ P O D _ N A M E   M Y _ P O D _ N A M E S P A C E ;   p r i n t e n v   M Y _ P O D _ I P   M Y _ P O D _ S E R V I C E _ A C C O U N T ;   s l e e p   1 0 ;   d o n e ;   e n v :   -   n a m e :   M Y _ N O D E _ N A M E   v a l u e F r o m :   f i e l d R e f :   f i e l d P a t h :   s p e c . n o d e N a m e   -   n a m e :   M Y _ P O D _ N A M E   v a l u e F r o m :   f i e l d R e f :   f i e l d P a t h :   m e t a d a t a . n a m e   -   n a m e :   M Y _ P O D _ N A M E S P A C E   v a l u e F r o m :   f i e l d R e f :   f i e l d P a t h :   m e t a d a t a . n a m e s p a c e   -   n a m e :   M Y _ P O D _ I P   v a l u e F r o m :   f i e l d R e f :   f i e l d P a t h :   s t a t u s . p o d I P   -   n a m e :   M Y _ P O D _ S E R V I C E _ A C C O U N T   v a l u e F r o m :   f i e l d R e f :   f i e l d P a t h :   s p e c . s e r v i c e A c c o u n t N a m e   r e s t a r t P o l i c y :   N e v e r   I n   t h a t   m a n i f e s t ,   y o u   c a n   s e e   f i v e   e n v i r o n m e n t   v a r i a b l e s .   T h e   e n v   f i e l d   i s   a n   a r r a y   o f   e n v i r o n m e n t   v a r i a b l e   d e f i n i t i o n s .   T h e   f i r s t   e l e m e n t   i n   t h e   a r r


Question: What is Note:?

Answer: C r e a t e   t h e   P o d :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / i n j e c t / d a p i - e n v a r s - p o d . y a m l   V e r i f y   t h a t   t h e   c o n t a i n e r   i n   t h e   P o d   i s   r u n n i n g :   #   I f   t h e   n e w   P o d   i s n ' t   y e t   h e a l t h y ,   r e r u n   t h i s   c o m m a n d   a   f e w   t i m e s .   k u b e c t l   g e t   p o d s   V i e w   t h e   c o n t a i n e r ' s   l o g s :   k u b e c t l   l o g s   d a p i - e n v a r s - f i e l d r e f   T h e   o u t p u t   s h o w s   t h e   v a l u e s   o f   s e l e c t e d   e n v i r o n m e n t   v a r i a b l e s :   m i n i k u b e   d a p i - e n v a r s - f i e l d r e f   d e f a u l t   1 7 2 . 1 7 . 0 . 4   d e f a u l t   T o   s e e   w h y   t h e s e   v a l u e s   a r e   i n   t h e   l o g ,   l o o k   a t   t h e   c o m m a n d   a n d   a r g s   f i e l d s   i n   t h e   c o n f i g u r a t i o n   f i l e .   W h e n   t h e   c o n t a i n e r   s t a r t s ,   i t   w r i t e s   t h e   v a l u e s   o f   f i v e   e n v i r o n m e n t   v a r i a b l e s   t o   s t d o u t .   I t   r e p e a t s   t h i s   e v e r y   t e n   s e c o n d s .   N e x t ,   g e t   a   s h e l l   i n t o   t h e   c o n t a i n e r   t h a t   i s   r u n n i n g   i n   y o u r   P o d :   k u b e c t l   e x e c   - i t   d a p i - e n v a r s - f i e l d r e f   - -   s h   I n   y o u r   s h e l l ,   v i e w   t h e   e n v i r o n m e n t   v a r i a b l e s :   #   R u n   t h i s   i n   a   s h e l l   i n s i d e   t h e   c o n t a i n e r   p r i n t e n v   T h e   o u t p u t   s h o w s   t h a t   c e r t a i n   e n v i r o n m e n t   v a r i a b l e s   h a v e   b e e n   a s s i g n e d   t h e   v a l u e s   o f   P o d   f i e l d s :   M Y _ P O D _ S E R V I C E _ A C C O U N T = d e f a u l t   . . .   M Y _ P O D _ N A M E S P A C E = d e f a u l t   M Y


Question: What is Use container fields as values for environment variables?

Answer: I n   t h e   p r e c e d i n g   e x e r c i s e ,   y o u   u s e d   i n f o r m a t i o n   f r o m   P o d - l e v e l   f i e l d s   a s   t h e   v a l u e s   f o r   e n v i r o n m e n t   v a r i a b l e s .   I n   t h i s   n e x t   e x e r c i s e ,   y o u   a r e   g o i n g   t o   p a s s   f i e l d s   t h a t   a r e   p a r t   o f   t h e   P o d   d e f i n i t i o n ,   b u t   t a k e n   f r o m   t h e   s p e c i f i c   c o n t a i n e r   r a t h e r   t h a n   f r o m   t h e   P o d   o v e r a l l .   H e r e   i s   a   m a n i f e s t   f o r   a n o t h e r   P o d   t h a t   a g a i n   h a s   j u s t   o n e   c o n t a i n e r :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   d a p i - e n v a r s - r e s o u r c e f i e l d r e f   s p e c :   c o n t a i n e r s :   -   n a m e :   t e s t - c o n t a i n e r   i m a g e :   r e g i s t r y . k 8 s . i o / b u s y b o x : 1 . 2 7 . 2   c o m m a n d :   [   " s h " ,   " - c " ]   a r g s :   -   w h i l e   t r u e ;   d o   e c h o   - e n   ' \ n ' ;   p r i n t e n v   M Y _ C P U _ R E Q U E S T   M Y _ C P U _ L I M I T ;   p r i n t e n v   M Y _ M E M _ R E Q U E S T   M Y _ M E M _ L I M I T ;   s l e e p   1 0 ;   d o n e ;   r e s o u r c e s :   r e q u e s t s :   m e m o r y :   " 3 2 M i "   c p u :   " 1 2 5 m "   l i m i t s :   m e m o r y :   " 6 4 M i "   c p u :   " 2 5 0 m "   e n v :   -   n a m e :   M Y _ C P U _ R E Q U E S T   v a l u e F r o m :   r e s o u r c e F i e l d R e f :   c o n t a i n e r N a m e :   t e s t - c o n t a i n e r   r e s o u r c e :   r e q u e s t s . c p u   -   n a m e :   M Y _ C P U _ L I M I T   v a l u e F r o m :   r e s o u r c e F i e l d R e f :   c o n t a i n e r N a m e :   t e s t - c o n t a i n e r   r e s o u r c e :   l i m i t s . c p u   -   n a m e :   M Y _ M E M _ R E Q U E S T   v a l u e F r o m :   r e s o u r c e F i e l d R e f :   c o n t a i n e r N


Question: What is What's next?

Answer: R e a d   D e f i n i n g   E n v i r o n m e n t   V a r i a b l e s   f o r   a   C o n t a i n e r R e a d   t h e   s p e c   A P I   d e f i n i t i o n   f o r   P o d .   T h i s   i n c l u d e s   t h e   d e f i n i t i o n   o f   C o n t a i n e r   ( p a r t   o f   P o d ) . R e a d   t h e   l i s t   o f   a v a i l a b l e   f i e l d s   t h a t   y o u   c a n   e x p o s e   u s i n g   t h e   d o w n w a r d   A P I .   R e a d   a b o u t   P o d s ,   c o n t a i n e r s   a n d   e n v i r o n m e n t   v a r i a b l e s   i n   t h e   l e g a c y   A P I   r e f e r e n c e :   P o d S p e c C o n t a i n e r E n v V a r E n v V a r S o u r c e O b j e c t F i e l d S e l e c t o r R e s o u r c e F i e l d S e l e c t o r


Question: What is kubeadm reset phase?

Answer: kubeadm reset phasekubeadm reset phase enables you to invoke atomic steps of the node reset process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm reset phase is consistent with the kubeadm reset workflow, and behind the scene both use the same code.kubeadm reset phaseSynopsisUse this command to invoke single phase of the "reset" workflowkubeadm reset phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase preflightUsing this phase you can execute preflight checks on a node that is being reset.Run reset pre-flight checksSynopsisRun pre-flight checks for kubeadm reset.kubeadm reset phase preflight [flags] Options--dry-runDon't apply any changes; just output what would be done.-f, --forceReset the node without prompting for confirmation.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase remove-etcd-memberUsing this phase you can remove this control-plane node's etcd member from the etcd cluster.SynopsisRemove a local etcd member for a control plane node.kubeadm reset phase remove-etcd-member [flags] Options--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for remove-etcd-member--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase cleanup-nodeUsing this phase you can perform cleanup on this node.SynopsisRun cleanup node.kubeadm reset phase cleanup-node [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path to the directory where the certificates are stored. If specified, clean this directory.--cleanup-tmp-dirCleanup the "/etc/kubernetes/tmp" directory--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for cleanup-nodeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to rev


Question: How does kubeadm reset phase work?

Answer: kubeadm reset phasekubeadm reset phase enables you to invoke atomic steps of the node reset process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm reset phase is consistent with the kubeadm reset workflow, and behind the scene both use the same code.kubeadm reset phaseSynopsisUse this command to invoke single phase of the "reset" workflowkubeadm reset phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase preflightUsing this phase you can execute preflight checks on a node that is being reset.Run reset pre-flight checksSynopsisRun pre-flight checks for kubeadm reset.kubeadm reset phase preflight [flags] Options--dry-runDon't apply any changes; just output what would be done.-f, --forceReset the node without prompting for confirmation.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase remove-etcd-memberUsing this phase you can remove this control-plane node's etcd member from the etcd cluster.SynopsisRemove a local etcd member for a control plane node.kubeadm reset phase remove-etcd-member [flags] Options--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for remove-etcd-member--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase cleanup-nodeUsing this phase you can perform cleanup on this node.SynopsisRun cleanup node.kubeadm reset phase cleanup-node [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path to the directory where the certificates are stored. If specified, clean this directory.--cleanup-tmp-dirCleanup the "/etc/kubernetes/tmp" directory--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for cleanup-nodeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to rev


Question: When would you use kubeadm reset phase?

Answer: kubeadm reset phasekubeadm reset phase enables you to invoke atomic steps of the node reset process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm reset phase is consistent with the kubeadm reset workflow, and behind the scene both use the same code.kubeadm reset phaseSynopsisUse this command to invoke single phase of the "reset" workflowkubeadm reset phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase preflightUsing this phase you can execute preflight checks on a node that is being reset.Run reset pre-flight checksSynopsisRun pre-flight checks for kubeadm reset.kubeadm reset phase preflight [flags] Options--dry-runDon't apply any changes; just output what would be done.-f, --forceReset the node without prompting for confirmation.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase remove-etcd-memberUsing this phase you can remove this control-plane node's etcd member from the etcd cluster.SynopsisRemove a local etcd member for a control plane node.kubeadm reset phase remove-etcd-member [flags] Options--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for remove-etcd-member--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase cleanup-nodeUsing this phase you can perform cleanup on this node.SynopsisRun cleanup node.kubeadm reset phase cleanup-node [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path to the directory where the certificates are stored. If specified, clean this directory.--cleanup-tmp-dirCleanup the "/etc/kubernetes/tmp" directory--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for cleanup-nodeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to rev


Question: What are the benefits of kubeadm reset phase?

Answer: kubeadm reset phasekubeadm reset phase enables you to invoke atomic steps of the node reset process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm reset phase is consistent with the kubeadm reset workflow, and behind the scene both use the same code.kubeadm reset phaseSynopsisUse this command to invoke single phase of the "reset" workflowkubeadm reset phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase preflightUsing this phase you can execute preflight checks on a node that is being reset.Run reset pre-flight checksSynopsisRun pre-flight checks for kubeadm reset.kubeadm reset phase preflight [flags] Options--dry-runDon't apply any changes; just output what would be done.-f, --forceReset the node without prompting for confirmation.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase remove-etcd-memberUsing this phase you can remove this control-plane node's etcd member from the etcd cluster.SynopsisRemove a local etcd member for a control plane node.kubeadm reset phase remove-etcd-member [flags] Options--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for remove-etcd-member--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase cleanup-nodeUsing this phase you can perform cleanup on this node.SynopsisRun cleanup node.kubeadm reset phase cleanup-node [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path to the directory where the certificates are stored. If specified, clean this directory.--cleanup-tmp-dirCleanup the "/etc/kubernetes/tmp" directory--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for cleanup-nodeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to rev


Question: What is kubeadm reset phase?

Answer: k u b e a d m   r e s e t   p h a s e   e n a b l e s   y o u   t o   i n v o k e   a t o m i c   s t e p s   o f   t h e   n o d e   r e s e t   p r o c e s s .   H e n c e ,   y o u   c a n   l e t   k u b e a d m   d o   s o m e   o f   t h e   w o r k   a n d   y o u   c a n   f i l l   i n   t h e   g a p s   i f   y o u   w i s h   t o   a p p l y   c u s t o m i z a t i o n .   k u b e a d m   r e s e t   p h a s e   i s   c o n s i s t e n t   w i t h   t h e   k u b e a d m   r e s e t   w o r k f l o w ,   a n d   b e h i n d   t h e   s c e n e   b o t h   u s e   t h e   s a m e   c o d e .


Question: What is kubeadm reset phase?

Answer: S y n o p s i s U s e   t h i s   c o m m a n d   t o   i n v o k e   s i n g l e   p h a s e   o f   t h e   " r e s e t "   w o r k f l o w k u b e a d m   r e s e t   p h a s e   [ f l a g s ]   O p t i o n s - h ,   - - h e l p h e l p   f o r   p h a s e O p t i o n s   i n h e r i t e d   f r o m   p a r e n t   c o m m a n d s - - r o o t f s   s t r i n g T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is Synopsis?

Answer: U s e   t h i s   c o m m a n d   t o   i n v o k e   s i n g l e   p h a s e   o f   t h e   " r e s e t "   w o r k f l o w   k u b e a d m   r e s e t   p h a s e   [ f l a g s ]


Question: What is Options?

Answer: h e l p   f o r   p h a s e


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is kubeadm reset phase preflight?

Answer: U s i n g   t h i s   p h a s e   y o u   c a n   e x e c u t e   p r e f l i g h t   c h e c k s   o n   a   n o d e   t h a t   i s   b e i n g   r e s e t .   R u n   r e s e t   p r e - f l i g h t   c h e c k s S y n o p s i s R u n   p r e - f l i g h t   c h e c k s   f o r   k u b e a d m   r e s e t . k u b e a d m   r e s e t   p h a s e   p r e f l i g h t   [ f l a g s ]   O p t i o n s - - d r y - r u n D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e . - f ,   - - f o r c e R e s e t   t h e   n o d e   w i t h o u t   p r o m p t i n g   f o r   c o n f i r m a t i o n . - h ,   - - h e l p h e l p   f o r   p r e f l i g h t - - i g n o r e - p r e f l i g h t - e r r o r s   s t r i n g s A   l i s t   o f   c h e c k s   w h o s e   e r r o r s   w i l l   b e   s h o w n   a s   w a r n i n g s .   E x a m p l e :   ' I s P r i v i l e g e d U s e r , S w a p ' .   V a l u e   ' a l l '   i g n o r e s   e r r o r s   f r o m   a l l   c h e c k s . O p t i o n s   i n h e r i t e d   f r o m   p a r e n t   c o m m a n d s - - r o o t f s   s t r i n g T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .   R u n   r e s e t   p r e - f l i g h t   c h e c k s


Question: What is Synopsis?

Answer: R u n   p r e - f l i g h t   c h e c k s   f o r   k u b e a d m   r e s e t .   k u b e a d m   r e s e t   p h a s e   p r e f l i g h t   [ f l a g s ]


Question: What is Options?

Answer: D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e .   R e s e t   t h e   n o d e   w i t h o u t   p r o m p t i n g   f o r   c o n f i r m a t i o n .   h e l p   f o r   p r e f l i g h t   A   l i s t   o f   c h e c k s   w h o s e   e r r o r s   w i l l   b e   s h o w n   a s   w a r n i n g s .   E x a m p l e :   ' I s P r i v i l e g e d U s e r , S w a p ' .   V a l u e   ' a l l '   i g n o r e s   e r r o r s   f r o m   a l l   c h e c k s .


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is kubeadm reset phase remove-etcd-member?

Answer: U s i n g   t h i s   p h a s e   y o u   c a n   r e m o v e   t h i s   c o n t r o l - p l a n e   n o d e ' s   e t c d   m e m b e r   f r o m   t h e   e t c d   c l u s t e r .   S y n o p s i s R e m o v e   a   l o c a l   e t c d   m e m b e r   f o r   a   c o n t r o l   p l a n e   n o d e . k u b e a d m   r e s e t   p h a s e   r e m o v e - e t c d - m e m b e r   [ f l a g s ]   O p t i o n s - - d r y - r u n D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e . - h ,   - - h e l p h e l p   f o r   r e m o v e - e t c d - m e m b e r - - k u b e c o n f i g   s t r i n g   D e f a u l t :   " / e t c / k u b e r n e t e s / a d m i n . c o n f " T h e   k u b e c o n f i g   f i l e   t o   u s e   w h e n   t a l k i n g   t o   t h e   c l u s t e r .   I f   t h e   f l a g   i s   n o t   s e t ,   a   s e t   o f   s t a n d a r d   l o c a t i o n s   c a n   b e   s e a r c h e d   f o r   a n   e x i s t i n g   k u b e c o n f i g   f i l e . O p t i o n s   i n h e r i t e d   f r o m   p a r e n t   c o m m a n d s - - r o o t f s   s t r i n g T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is Synopsis?

Answer: R e m o v e   a   l o c a l   e t c d   m e m b e r   f o r   a   c o n t r o l   p l a n e   n o d e .   k u b e a d m   r e s e t   p h a s e   r e m o v e - e t c d - m e m b e r   [ f l a g s ]


Question: What is Options?

Answer: D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e .   h e l p   f o r   r e m o v e - e t c d - m e m b e r   T h e   k u b e c o n f i g   f i l e   t o   u s e   w h e n   t a l k i n g   t o   t h e   c l u s t e r .   I f   t h e   f l a g   i s   n o t   s e t ,   a   s e t   o f   s t a n d a r d   l o c a t i o n s   c a n   b e   s e a r c h e d   f o r   a n   e x i s t i n g   k u b e c o n f i g   f i l e .


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is kubeadm reset phase cleanup-node?

Answer: U s i n g   t h i s   p h a s e   y o u   c a n   p e r f o r m   c l e a n u p   o n   t h i s   n o d e .   S y n o p s i s R u n   c l e a n u p   n o d e . k u b e a d m   r e s e t   p h a s e   c l e a n u p - n o d e   [ f l a g s ]   O p t i o n s - - c e r t - d i r   s t r i n g   D e f a u l t :   " / e t c / k u b e r n e t e s / p k i " T h e   p a t h   t o   t h e   d i r e c t o r y   w h e r e   t h e   c e r t i f i c a t e s   a r e   s t o r e d .   I f   s p e c i f i e d ,   c l e a n   t h i s   d i r e c t o r y . - - c l e a n u p - t m p - d i r C l e a n u p   t h e   " / e t c / k u b e r n e t e s / t m p "   d i r e c t o r y - - c r i - s o c k e t   s t r i n g P a t h   t o   t h e   C R I   s o c k e t   t o   c o n n e c t .   I f   e m p t y   k u b e a d m   w i l l   t r y   t o   a u t o - d e t e c t   t h i s   v a l u e ;   u s e   t h i s   o p t i o n   o n l y   i f   y o u   h a v e   m o r e   t h a n   o n e   C R I   i n s t a l l e d   o r   i f   y o u   h a v e   n o n - s t a n d a r d   C R I   s o c k e t . - - d r y - r u n D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e . - h ,   - - h e l p h e l p   f o r   c l e a n u p - n o d e O p t i o n s   i n h e r i t e d   f r o m   p a r e n t   c o m m a n d s - - r o o t f s   s t r i n g T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is Synopsis?

Answer: R u n   c l e a n u p   n o d e .   k u b e a d m   r e s e t   p h a s e   c l e a n u p - n o d e   [ f l a g s ]


Question: What is Options?

Answer: T h e   p a t h   t o   t h e   d i r e c t o r y   w h e r e   t h e   c e r t i f i c a t e s   a r e   s t o r e d .   I f   s p e c i f i e d ,   c l e a n   t h i s   d i r e c t o r y .   C l e a n u p   t h e   " / e t c / k u b e r n e t e s / t m p "   d i r e c t o r y   P a t h   t o   t h e   C R I   s o c k e t   t o   c o n n e c t .   I f   e m p t y   k u b e a d m   w i l l   t r y   t o   a u t o - d e t e c t   t h i s   v a l u e ;   u s e   t h i s   o p t i o n   o n l y   i f   y o u   h a v e   m o r e   t h a n   o n e   C R I   i n s t a l l e d   o r   i f   y o u   h a v e   n o n - s t a n d a r d   C R I   s o c k e t .   D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e .   h e l p   f o r   c l e a n u p - n o d e


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is What's next?

Answer: k u b e a d m   i n i t   t o   b o o t s t r a p   a   K u b e r n e t e s   c o n t r o l - p l a n e   n o d e k u b e a d m   j o i n   t o   c o n n e c t   a   n o d e   t o   t h e   c l u s t e r k u b e a d m   r e s e t   t o   r e v e r t   a n y   c h a n g e s   m a d e   t o   t h i s   h o s t   b y   k u b e a d m   i n i t   o r   k u b e a d m   j o i n k u b e a d m   a l p h a   t o   t r y   e x p e r i m e n t a l   f u n c t i o n a l i t y


Question: What is kube-apiserver Admission (v1)?

Answer: kube-apiserver Admission (v1)Resource TypesAdmissionReviewAdmissionReviewAdmissionReview describes an admission review request/response.FieldDescriptionapiVersionstringadmission.k8s.io/v1kindstringAdmissionReviewrequestAdmissionRequestRequest describes the attributes for the admission request.responseAdmissionResponseResponse describes the attributes for the admission response.AdmissionRequestAppears in:AdmissionReviewAdmissionRequest describes the admission.Attributes for the admission request.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.kind [Required]meta/v1.GroupVersionKindKind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)resource [Required]meta/v1.GroupVersionResourceResource is the fully-qualified resource being requested (for example, v1.pods)subResourcestringSubResource is the subresource being requested, if any (for example, "status" or "scale")requestKindmeta/v1.GroupVersionKindRequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for), and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type for more details.requestResourcemeta/v1.GroupVersionResourceRequestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for), and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicati


Question: How does kube-apiserver Admission (v1) work?

Answer: kube-apiserver Admission (v1)Resource TypesAdmissionReviewAdmissionReviewAdmissionReview describes an admission review request/response.FieldDescriptionapiVersionstringadmission.k8s.io/v1kindstringAdmissionReviewrequestAdmissionRequestRequest describes the attributes for the admission request.responseAdmissionResponseResponse describes the attributes for the admission response.AdmissionRequestAppears in:AdmissionReviewAdmissionRequest describes the admission.Attributes for the admission request.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.kind [Required]meta/v1.GroupVersionKindKind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)resource [Required]meta/v1.GroupVersionResourceResource is the fully-qualified resource being requested (for example, v1.pods)subResourcestringSubResource is the subresource being requested, if any (for example, "status" or "scale")requestKindmeta/v1.GroupVersionKindRequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for), and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type for more details.requestResourcemeta/v1.GroupVersionResourceRequestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for), and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicati


Question: When would you use kube-apiserver Admission (v1)?

Answer: kube-apiserver Admission (v1)Resource TypesAdmissionReviewAdmissionReviewAdmissionReview describes an admission review request/response.FieldDescriptionapiVersionstringadmission.k8s.io/v1kindstringAdmissionReviewrequestAdmissionRequestRequest describes the attributes for the admission request.responseAdmissionResponseResponse describes the attributes for the admission response.AdmissionRequestAppears in:AdmissionReviewAdmissionRequest describes the admission.Attributes for the admission request.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.kind [Required]meta/v1.GroupVersionKindKind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)resource [Required]meta/v1.GroupVersionResourceResource is the fully-qualified resource being requested (for example, v1.pods)subResourcestringSubResource is the subresource being requested, if any (for example, "status" or "scale")requestKindmeta/v1.GroupVersionKindRequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for), and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type for more details.requestResourcemeta/v1.GroupVersionResourceRequestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for), and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicati


Question: What are the benefits of kube-apiserver Admission (v1)?

Answer: kube-apiserver Admission (v1)Resource TypesAdmissionReviewAdmissionReviewAdmissionReview describes an admission review request/response.FieldDescriptionapiVersionstringadmission.k8s.io/v1kindstringAdmissionReviewrequestAdmissionRequestRequest describes the attributes for the admission request.responseAdmissionResponseResponse describes the attributes for the admission response.AdmissionRequestAppears in:AdmissionReviewAdmissionRequest describes the admission.Attributes for the admission request.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.kind [Required]meta/v1.GroupVersionKindKind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)resource [Required]meta/v1.GroupVersionResourceResource is the fully-qualified resource being requested (for example, v1.pods)subResourcestringSubResource is the subresource being requested, if any (for example, "status" or "scale")requestKindmeta/v1.GroupVersionKindRequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for), and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type for more details.requestResourcemeta/v1.GroupVersionResourceRequestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for), and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicati


Question: What is Resource Types?

Answer: A d m i s s i o n R e v i e w


Question: What is AdmissionReview?

Answer: A d m i s s i o n R e v i e w   d e s c r i b e s   a n   a d m i s s i o n   r e v i e w   r e q u e s t / r e s p o n s e .   R e q u e s t   d e s c r i b e s   t h e   a t t r i b u t e s   f o r   t h e   a d m i s s i o n   r e q u e s t .   R e s p o n s e   d e s c r i b e s   t h e   a t t r i b u t e s   f o r   t h e   a d m i s s i o n   r e s p o n s e .


Question: What is AdmissionRequest?

Answer: A p p e a r s   i n :   A d m i s s i o n R e v i e w   A d m i s s i o n R e q u e s t   d e s c r i b e s   t h e   a d m i s s i o n . A t t r i b u t e s   f o r   t h e   a d m i s s i o n   r e q u e s t .   U I D   i s   a n   i d e n t i f i e r   f o r   t h e   i n d i v i d u a l   r e q u e s t / r e s p o n s e .   I t   a l l o w s   u s   t o   d i s t i n g u i s h   i n s t a n c e s   o f   r e q u e s t s   w h i c h   a r e   o t h e r w i s e   i d e n t i c a l   ( p a r a l l e l   r e q u e s t s ,   r e q u e s t s   w h e n   e a r l i e r   r e q u e s t s   d i d   n o t   m o d i f y   e t c )   T h e   U I D   i s   m e a n t   t o   t r a c k   t h e   r o u n d   t r i p   ( r e q u e s t / r e s p o n s e )   b e t w e e n   t h e   K A S   a n d   t h e   W e b H o o k ,   n o t   t h e   u s e r   r e q u e s t .   I t   i s   s u i t a b l e   f o r   c o r r e l a t i n g   l o g   e n t r i e s   b e t w e e n   t h e   w e b h o o k   a n d   a p i s e r v e r ,   f o r   e i t h e r   a u d i t i n g   o r   d e b u g g i n g .   K i n d   i s   t h e   f u l l y - q u a l i f i e d   t y p e   o f   o b j e c t   b e i n g   s u b m i t t e d   ( f o r   e x a m p l e ,   v 1 . P o d   o r   a u t o s c a l i n g . v 1 . S c a l e )   R e s o u r c e   i s   t h e   f u l l y - q u a l i f i e d   r e s o u r c e   b e i n g   r e q u e s t e d   ( f o r   e x a m p l e ,   v 1 . p o d s )   S u b R e s o u r c e   i s   t h e   s u b r e s o u r c e   b e i n g   r e q u e s t e d ,   i f   a n y   ( f o r   e x a m p l e ,   " s t a t u s "   o r   " s c a l e " )   R e q u e s t K i n d   i s   t h e   f u l l y - q u a l i f i e d   t y p e   o f   t h e   o r i g i n a l   A P I   r e q u e s t   ( f o r   e x a m p l e ,   v 1 . P o d   o r   a u t o s c a l i n g . v 1 . S c a l e ) .   I f   t h i s   i s   s p e c i f i e d   a n d   d i f f e r s   f r o m   t h e   v a l u e   i n   " k i n d " ,   a n   e q u i v


Question: What is AdmissionResponse?

Answer: A p p e a r s   i n :   A d m i s s i o n R e v i e w   A d m i s s i o n R e s p o n s e   d e s c r i b e s   a n   a d m i s s i o n   r e s p o n s e .   U I D   i s   a n   i d e n t i f i e r   f o r   t h e   i n d i v i d u a l   r e q u e s t / r e s p o n s e .   T h i s   m u s t   b e   c o p i e d   o v e r   f r o m   t h e   c o r r e s p o n d i n g   A d m i s s i o n R e q u e s t .   A l l o w e d   i n d i c a t e s   w h e t h e r   o r   n o t   t h e   a d m i s s i o n   r e q u e s t   w a s   p e r m i t t e d .   R e s u l t   c o n t a i n s   e x t r a   d e t a i l s   i n t o   w h y   a n   a d m i s s i o n   r e q u e s t   w a s   d e n i e d .   T h i s   f i e l d   I S   N O T   c o n s u l t e d   i n   a n y   w a y   i f   " A l l o w e d "   i s   " t r u e " .   T h e   p a t c h   b o d y .   C u r r e n t l y   w e   o n l y   s u p p o r t   " J S O N P a t c h "   w h i c h   i m p l e m e n t s   R F C   6 9 0 2 .   T h e   t y p e   o f   P a t c h .   C u r r e n t l y   w e   o n l y   a l l o w   " J S O N P a t c h " .   A u d i t A n n o t a t i o n s   i s   a n   u n s t r u c t u r e d   k e y   v a l u e   m a p   s e t   b y   r e m o t e   a d m i s s i o n   c o n t r o l l e r   ( e . g .   e r r o r = i m a g e - b l a c k l i s t e d ) .   M u t a t i n g A d m i s s i o n W e b h o o k   a n d   V a l i d a t i n g A d m i s s i o n W e b h o o k   a d m i s s i o n   c o n t r o l l e r   w i l l   p r e f i x   t h e   k e y s   w i t h   a d m i s s i o n   w e b h o o k   n a m e   ( e . g .   i m a g e p o l i c y . e x a m p l e . c o m / e r r o r = i m a g e - b l a c k l i s t e d ) .   A u d i t A n n o t a t i o n s   w i l l   b e   p r o v i d e d   b y   t h e   a d m i s s i o n   w e b h o o k   t o   a d d   a d d i t i o n a l   c o n t e x t   t o   t h e   a u d i t   l o g   f o r   t h i s   r e q u e s t .   w a r n i n g s   i s   a   l i s t   o f   w a r n i n g   m e s s a g


Question: What is Operation?

Answer: ( A l i a s   o f   s t r i n g )   A p p e a r s   i n :   A d m i s s i o n R e q u e s t   O p e r a t i o n   i s   t h e   t y p e   o f   r e s o u r c e   o p e r a t i o n   b e i n g   c h e c k e d   f o r   a d m i s s i o n   c o n t r o l


Question: What is PatchType?

Answer: ( A l i a s   o f   s t r i n g )   A p p e a r s   i n :   A d m i s s i o n R e s p o n s e   P a t c h T y p e   i s   t h e   t y p e   o f   p a t c h   b e i n g   u s e d   t o   r e p r e s e n t   t h e   m u t a t e d   o b j e c t   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is VolumeAttachment?

Answer: VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttachment objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentmetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (VolumeAttachmentSpec), requiredspec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.status (VolumeAttachmentStatus)status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.VolumeAttachmentSpecVolumeAttachmentSpec is the specification of a VolumeAttachment request.attacher (string), requiredattacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().nodeName (string), requirednodeName represents the node that the volume should be attached to.source (VolumeAttachmentSource), requiredsource represents the volume that should be attached.VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.source.inlineVolumeSpec (PersistentVolumeSpec)inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.source.persistentVolumeName (string)persistentVolumeName represents the name of the persistent volume to attach.VolumeAttachmentStatusVolumeAttachmentStatus is the status of a VolumeAttachment request.attached (boolean), requiredattached indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.attachError (VolumeError)attachError represents the last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.attachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.attachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so i


Question: How does VolumeAttachment work?

Answer: VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttachment objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentmetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (VolumeAttachmentSpec), requiredspec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.status (VolumeAttachmentStatus)status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.VolumeAttachmentSpecVolumeAttachmentSpec is the specification of a VolumeAttachment request.attacher (string), requiredattacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().nodeName (string), requirednodeName represents the node that the volume should be attached to.source (VolumeAttachmentSource), requiredsource represents the volume that should be attached.VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.source.inlineVolumeSpec (PersistentVolumeSpec)inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.source.persistentVolumeName (string)persistentVolumeName represents the name of the persistent volume to attach.VolumeAttachmentStatusVolumeAttachmentStatus is the status of a VolumeAttachment request.attached (boolean), requiredattached indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.attachError (VolumeError)attachError represents the last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.attachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.attachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so i


Question: When would you use VolumeAttachment?

Answer: VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttachment objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentmetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (VolumeAttachmentSpec), requiredspec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.status (VolumeAttachmentStatus)status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.VolumeAttachmentSpecVolumeAttachmentSpec is the specification of a VolumeAttachment request.attacher (string), requiredattacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().nodeName (string), requirednodeName represents the node that the volume should be attached to.source (VolumeAttachmentSource), requiredsource represents the volume that should be attached.VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.source.inlineVolumeSpec (PersistentVolumeSpec)inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.source.persistentVolumeName (string)persistentVolumeName represents the name of the persistent volume to attach.VolumeAttachmentStatusVolumeAttachmentStatus is the status of a VolumeAttachment request.attached (boolean), requiredattached indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.attachError (VolumeError)attachError represents the last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.attachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.attachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so i


Question: What are the benefits of VolumeAttachment?

Answer: VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttachment objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentmetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (VolumeAttachmentSpec), requiredspec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.status (VolumeAttachmentStatus)status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.VolumeAttachmentSpecVolumeAttachmentSpec is the specification of a VolumeAttachment request.attacher (string), requiredattacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().nodeName (string), requirednodeName represents the node that the volume should be attached to.source (VolumeAttachmentSource), requiredsource represents the volume that should be attached.VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.source.inlineVolumeSpec (PersistentVolumeSpec)inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.source.persistentVolumeName (string)persistentVolumeName represents the name of the persistent volume to attach.VolumeAttachmentStatusVolumeAttachmentStatus is the status of a VolumeAttachment request.attached (boolean), requiredattached indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.attachError (VolumeError)attachError represents the last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.attachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.attachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so i


Question: What is VolumeAttachment?

Answer: a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / s t o r a g e / v 1 "


Question: What is VolumeAttachment?

Answer: V o l u m e A t t a c h m e n t   c a p t u r e s   t h e   i n t e n t   t o   a t t a c h   o r   d e t a c h   t h e   s p e c i f i e d   v o l u m e   t o / f r o m   t h e   s p e c i f i e d   n o d e .   V o l u m e A t t a c h m e n t   o b j e c t s   a r e   n o n - n a m e s p a c e d .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1 k i n d :   V o l u m e A t t a c h m e n t m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( V o l u m e A t t a c h m e n t S p e c ) ,   r e q u i r e d s p e c   r e p r e s e n t s   s p e c i f i c a t i o n   o f   t h e   d e s i r e d   a t t a c h / d e t a c h   v o l u m e   b e h a v i o r .   P o p u l a t e d   b y   t h e   K u b e r n e t e s   s y s t e m . s t a t u s   ( V o l u m e A t t a c h m e n t S t a t u s ) s t a t u s   r e p r e s e n t s   s t a t u s   o f   t h e   V o l u m e A t t a c h m e n t   r e q u e s t .   P o p u l a t e d   b y   t h e   e n t i t y   c o m p l e t i n g   t h e   a t t a c h   o r   d e t a c h   o p e r a t i o n ,   i . e .   t h e   e x t e r n a l - a t t a c h e r .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e A t t a c h m e n t   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( V o l u m e A t t a c h m e n t S p e c ) ,   r e q u i r e d   s p e c   r e p r e s e n t s   s p e c i f i c a t i o n   o f   t h e   d e s i r e d   a t t a c h / d e t a c h   v o l u m e   b e h a v i o


Question: What is VolumeAttachmentSpec?

Answer: V o l u m e A t t a c h m e n t S p e c   i s   t h e   s p e c i f i c a t i o n   o f   a   V o l u m e A t t a c h m e n t   r e q u e s t .   a t t a c h e r   ( s t r i n g ) ,   r e q u i r e d a t t a c h e r   i n d i c a t e s   t h e   n a m e   o f   t h e   v o l u m e   d r i v e r   t h a t   M U S T   h a n d l e   t h i s   r e q u e s t .   T h i s   i s   t h e   n a m e   r e t u r n e d   b y   G e t P l u g i n N a m e ( ) . n o d e N a m e   ( s t r i n g ) ,   r e q u i r e d n o d e N a m e   r e p r e s e n t s   t h e   n o d e   t h a t   t h e   v o l u m e   s h o u l d   b e   a t t a c h e d   t o . s o u r c e   ( V o l u m e A t t a c h m e n t S o u r c e ) ,   r e q u i r e d s o u r c e   r e p r e s e n t s   t h e   v o l u m e   t h a t   s h o u l d   b e   a t t a c h e d . V o l u m e A t t a c h m e n t S o u r c e   r e p r e s e n t s   a   v o l u m e   t h a t   s h o u l d   b e   a t t a c h e d .   R i g h t   n o w   o n l y   P e r s i s t e n t V o l u m e s   c a n   b e   a t t a c h e d   v i a   e x t e r n a l   a t t a c h e r ,   i n   t h e   f u t u r e   w e   m a y   a l l o w   a l s o   i n l i n e   v o l u m e s   i n   p o d s .   E x a c t l y   o n e   m e m b e r   c a n   b e   s e t . s o u r c e . i n l i n e V o l u m e S p e c   ( P e r s i s t e n t V o l u m e S p e c ) i n l i n e V o l u m e S p e c   c o n t a i n s   a l l   t h e   i n f o r m a t i o n   n e c e s s a r y   t o   a t t a c h   a   p e r s i s t e n t   v o l u m e   d e f i n e d   b y   a   p o d ' s   i n l i n e   V o l u m e S o u r c e .   T h i s   f i e l d   i s   p o p u l a t e d   o n l y   f o r   t h e   C S I M i g r a t i o n   f e a t u r e .   I t   c o n t a i n s   t r a n s l a t e d   f i e l d s   f r o m   a   p o d ' s   i n l i n e   V o l u m e S o u r c e   t o   a   P e r s i s t e n t V o l u m e S p e c .   T h i s   f i e l d   i s   b e t a - l e v e l   a n d   i s   o n l y   h o n


Question: What is VolumeAttachmentStatus?

Answer: V o l u m e A t t a c h m e n t S t a t u s   i s   t h e   s t a t u s   o f   a   V o l u m e A t t a c h m e n t   r e q u e s t .   a t t a c h e d   ( b o o l e a n ) ,   r e q u i r e d a t t a c h e d   i n d i c a t e s   t h e   v o l u m e   i s   s u c c e s s f u l l y   a t t a c h e d .   T h i s   f i e l d   m u s t   o n l y   b e   s e t   b y   t h e   e n t i t y   c o m p l e t i n g   t h e   a t t a c h   o p e r a t i o n ,   i . e .   t h e   e x t e r n a l - a t t a c h e r . a t t a c h E r r o r   ( V o l u m e E r r o r ) a t t a c h E r r o r   r e p r e s e n t s   t h e   l a s t   e r r o r   e n c o u n t e r e d   d u r i n g   a t t a c h   o p e r a t i o n ,   i f   a n y .   T h i s   f i e l d   m u s t   o n l y   b e   s e t   b y   t h e   e n t i t y   c o m p l e t i n g   t h e   a t t a c h   o p e r a t i o n ,   i . e .   t h e   e x t e r n a l - a t t a c h e r . V o l u m e E r r o r   c a p t u r e s   a n   e r r o r   e n c o u n t e r e d   d u r i n g   a   v o l u m e   o p e r a t i o n . a t t a c h E r r o r . e r r o r C o d e   ( i n t 3 2 ) e r r o r C o d e   i s   a   n u m e r i c   g R P C   c o d e   r e p r e s e n t i n g   t h e   e r r o r   e n c o u n t e r e d   d u r i n g   A t t a c h   o r   D e t a c h   o p e r a t i o n s . T h i s   i s   a n   o p t i o n a l ,   b e t a   f i e l d   t h a t   r e q u i r e s   t h e   M u t a b l e C S I N o d e A l l o c a t a b l e C o u n t   f e a t u r e   g a t e   b e i n g   e n a b l e d   t o   b e   s e t . a t t a c h E r r o r . m e s s a g e   ( s t r i n g ) m e s s a g e   r e p r e s e n t s   t h e   e r r o r   e n c o u n t e r e d   d u r i n g   A t t a c h   o r   D e t a c h   o p e r a t i o n .   T h i s   s t r i n g   m a y   b e   l o g g e d ,   s o   i t   s h o u l d   n o t   c o n t a i n   s e n s i t i v e   i n f o r m a t i o n . a t t a c h E r r o r . t i m e   ( T i m e ) t i m e   r e p r e s e n t s   t


Question: What is VolumeAttachmentList?

Answer: V o l u m e A t t a c h m e n t L i s t   i s   a   c o l l e c t i o n   o f   V o l u m e A t t a c h m e n t   o b j e c t s .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1 k i n d :   V o l u m e A t t a c h m e n t L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a i t e m s   ( [ ] V o l u m e A t t a c h m e n t ) ,   r e q u i r e d i t e m s   i s   t h e   l i s t   o f   V o l u m e A t t a c h m e n t s   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e A t t a c h m e n t L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   i t e m s   ( [ ] V o l u m e A t t a c h m e n t ) ,   r e q u i r e d   i t e m s   i s   t h e   l i s t   o f   V o l u m e A t t a c h m e n t s


Question: What is HTTP Request?

Answer: G E T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s


Question: What is Parameters?

Answer: b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 1   ( V o l u m e A t t a c h m e n t ) :   C r e a t e d   2 0 2   ( V o l u m e A t t a c h m e n t ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 1   ( V o l u m e A t t a c h m e n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   b o d y :   V o l u m e A t t a c h m e n t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 1   ( V o l u m e A t t a c h m e n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 1   ( V o l u m e A t t a c h m e n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 1   ( V o l u m e A t t a c h m e n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   V o l u m e A t t a c h m e n t b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   V o l u m e A t t a c h m e n t   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( V o l u m e A t t a c h m e n t ) :   O K   2 0 2   ( V o l u m e A t t a c h m e n t ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / s t o r a g e . k 8 s . i o / v 1 / v o l u m e a t t a c h m e n t s


Question: What is Parameters?

Answer: b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   l a b e l S e l e c t o r   (


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is SubjectAccessReview?

Answer: SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1kind: SubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SubjectAccessReviewSpec), requiredSpec holds information about the request being evaluatedstatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSubjectAccessReviewSpecSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setextra (map[string][]string)Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.groups ([]string)Atomic: will be replaced during a mergeGroups is the groups you're testing for.nonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook imp


Question: How does SubjectAccessReview work?

Answer: SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1kind: SubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SubjectAccessReviewSpec), requiredSpec holds information about the request being evaluatedstatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSubjectAccessReviewSpecSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setextra (map[string][]string)Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.groups ([]string)Atomic: will be replaced during a mergeGroups is the groups you're testing for.nonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook imp