Question: What is Pod status (TopologyAffinityError)?

Answer: T h i s   e r r o r   t y p i c a l l y   o c c u r s   i n   t h e   f o l l o w i n g   s i t u a t i o n s :   a   n o d e   h a s   n o t   e n o u g h   r e s o u r c e s   a v a i l a b l e   t o   s a t i s f y   t h e   p o d ' s   r e q u e s t t h e   p o d ' s   r e q u e s t   i s   r e j e c t e d   d u e   t o   p a r t i c u l a r   T o p o l o g y   M a n a g e r   p o l i c y   c o n s t r a i n t s   T h e   e r r o r   a p p e a r s   i n   t h e   s t a t u s   o f   a   p o d :   k u b e c t l   g e t   p o d s   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   g u a r a n t e e d   0 / 1   T o p o l o g y A f f i n i t y E r r o r   0   1 1 3 s   U s e   k u b e c t l   d e s c r i b e   p o d   < i d >   o r   k u b e c t l   g e t   e v e n t s   t o   o b t a i n   d e t a i l e d   e r r o r   m e s s a g e :   W a r n i n g   T o p o l o g y A f f i n i t y E r r o r   1 0 m   k u b e l e t ,   d e l l 8   R e s o u r c e s   c a n n o t   b e   a l l o c a t e d   w i t h   T o p o l o g y   l o c a l i t y


Question: What is System logs?

Answer: S e a r c h   s y s t e m   l o g s   w i t h   r e s p e c t   t o   a   p a r t i c u l a r   p o d .   T h e   s e t   o f   h i n t s   t h a t   M e m o r y   M a n a g e r   g e n e r a t e d   f o r   t h e   p o d   c a n   b e   f o u n d   i n   t h e   l o g s .   A l s o ,   t h e   s e t   o f   h i n t s   g e n e r a t e d   b y   C P U   M a n a g e r   s h o u l d   b e   p r e s e n t   i n   t h e   l o g s .   T o p o l o g y   M a n a g e r   m e r g e s   t h e s e   h i n t s   t o   c a l c u l a t e   a   s i n g l e   b e s t   h i n t .   T h e   b e s t   h i n t   s h o u l d   b e   a l s o   p r e s e n t   i n   t h e   l o g s .   T h e   b e s t   h i n t   i n d i c a t e s   w h e r e   t o   a l l o c a t e   a l l   t h e   r e s o u r c e s .   T o p o l o g y   M a n a g e r   t e s t s   t h i s   h i n t   a g a i n s t   i t s   c u r r e n t   p o l i c y ,   a n d   b a s e d   o n   t h e   v e r d i c t ,   i t   e i t h e r   a d m i t s   t h e   p o d   t o   t h e   n o d e   o r   r e j e c t s   i t .   A l s o ,   s e a r c h   t h e   l o g s   f o r   o c c u r r e n c e s   a s s o c i a t e d   w i t h   t h e   M e m o r y   M a n a g e r ,   e . g .   t o   f i n d   o u t   i n f o r m a t i o n   a b o u t   c g r o u p s   a n d   c p u s e t . m e m s   u p d a t e s .


Question: What is Examine the memory manager state on a node?

Answer: L e t   u s   f i r s t   d e p l o y   a   s a m p l e   G u a r a n t e e d   p o d   w h o s e   s p e c i f i c a t i o n   i s   a s   f o l l o w s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   g u a r a n t e e d   s p e c :   c o n t a i n e r s :   -   n a m e :   g u a r a n t e e d   i m a g e :   c o n s u m e r   i m a g e P u l l P o l i c y :   N e v e r   r e s o u r c e s :   l i m i t s :   c p u :   " 2 "   m e m o r y :   1 5 0 G i   r e q u e s t s :   c p u :   " 2 "   m e m o r y :   1 5 0 G i   c o m m a n d :   [ " s l e e p " , " i n f i n i t y " ]   N e x t ,   l e t   u s   l o g   i n t o   t h e   n o d e   w h e r e   i t   w a s   d e p l o y e d   a n d   e x a m i n e   t h e   s t a t e   f i l e   i n   / v a r / l i b / k u b e l e t / m e m o r y _ m a n a g e r _ s t a t e :   {   " p o l i c y N a m e " : " S t a t i c " ,   " m a c h i n e S t a t e " : {   " 0 " : {   " n u m b e r O f A s s i g n m e n t s " : 1 ,   " m e m o r y M a p " : {   " h u g e p a g e s - 1 G i " : {   " t o t a l " : 0 ,   " s y s t e m R e s e r v e d " : 0 ,   " a l l o c a t a b l e " : 0 ,   " r e s e r v e d " : 0 ,   " f r e e " : 0   } ,   " m e m o r y " : {   " t o t a l " : 1 3 4 9 8 7 3 5 4 1 1 2 ,   " s y s t e m R e s e r v e d " : 3 2 2 1 2 2 5 4 7 2 ,   " a l l o c a t a b l e " : 1 3 1 7 6 6 1 2 8 6 4 0 ,   " r e s e r v e d " : 1 3 1 7 6 6 1 2 8 6 4 0 ,   " f r e e " : 0   }   } ,   " n o d e s " : [   0 ,   1   ]   } ,   " 1 " : {   " n u m b e r O f A s s i g n m e n t s " : 1 ,   " m e m o r y M a p " : {   " h u g e p a g e s - 1 G i " : {   " t o t a l " : 0 ,   " s y s t e m R e s e r v e d " : 0 ,   " a l l o c a t a b l e " : 0 ,   " r e s e r v e d " : 0 ,   " f r e e " : 0   } ,   " m e m o r y " : {   " t o t a l " : 1 3 5 2 8 6 7 2 2 5 6 0 ,   " s y s t e m R e s e r v e d " : 2 2 5 2 3 4 1 2 4 8 ,   " a l l o c a t a b l e " : 1 3 3 0 3 4 3 8 1 3 1 2 ,   " r e s e r v e d " :


Question: What is Device plugin resource API?

Answer: T h e   k u b e l e t   p r o v i d e s   a   P o d R e s o u r c e L i s t e r   g R P C   s e r v i c e   t o   e n a b l e   d i s c o v e r y   o f   r e s o u r c e s   a n d   a s s o c i a t e d   m e t a d a t a .   B y   u s i n g   i t s   L i s t   g R P C   e n d p o i n t ,   i n f o r m a t i o n   a b o u t   r e s e r v e d   m e m o r y   f o r   e a c h   c o n t a i n e r   c a n   b e   r e t r i e v e d ,   w h i c h   i s   c o n t a i n e d   i n   p r o t o b u f   C o n t a i n e r M e m o r y   m e s s a g e .   T h i s   i n f o r m a t i o n   c a n   b e   r e t r i e v e d   s o l e l y   f o r   p o d s   i n   G u a r a n t e e d   Q o S   c l a s s .


Question: What is What's next?

Answer: M e m o r y   M a n a g e r   K E P :   D e s i g n   O v e r v i e w M e m o r y   M a n a g e r   K E P :   M e m o r y   M a p s   a t   s t a r t - u p   ( w i t h   e x a m p l e s ) M e m o r y   M a n a g e r   K E P :   M e m o r y   M a p s   a t   r u n t i m e   ( w i t h   e x a m p l e s ) M e m o r y   M a n a g e r   K E P :   S i m u l a t i o n   -   h o w   t h e   M e m o r y   M a n a g e r   w o r k s ?   ( b y   e x a m p l e s ) M e m o r y   M a n a g e r   K E P :   T h e   C o n c e p t   o f   N o d e   M a p   a n d   M e m o r y   M a p s M e m o r y   M a n a g e r   K E P :   H o w   t o   e n a b l e   t h e   g u a r a n t e e d   m e m o r y   a l l o c a t i o n   o v e r   m a n y   N U M A   n o d e s ?


Question: What is SelfSubjectAccessReview?

Answer: SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an actionapiVersion: authorization.k8s.io/v1kind: SelfSubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SelfSubjectAccessReviewSpec), requiredSpec holds information about the request being evaluated. user and groups must be emptystatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSelfSubjectAccessReviewSpecSelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setnonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSele


Question: How does SelfSubjectAccessReview work?

Answer: SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an actionapiVersion: authorization.k8s.io/v1kind: SelfSubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SelfSubjectAccessReviewSpec), requiredSpec holds information about the request being evaluated. user and groups must be emptystatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSelfSubjectAccessReviewSpecSelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setnonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSele


Question: When would you use SelfSubjectAccessReview?

Answer: SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an actionapiVersion: authorization.k8s.io/v1kind: SelfSubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SelfSubjectAccessReviewSpec), requiredSpec holds information about the request being evaluated. user and groups must be emptystatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSelfSubjectAccessReviewSpecSelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setnonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSele


Question: What are the benefits of SelfSubjectAccessReview?

Answer: SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an actionapiVersion: authorization.k8s.io/v1kind: SelfSubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SelfSubjectAccessReviewSpec), requiredSpec holds information about the request being evaluated. user and groups must be emptystatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSelfSubjectAccessReviewSpecSelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setnonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSele


Question: What is SelfSubjectAccessReview?

Answer: a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / a u t h o r i z a t i o n / v 1 "


Question: What is SelfSubjectAccessReview?

Answer: S e l f S u b j e c t A c c e s s R e v i e w   c h e c k s   w h e t h e r   o r   t h e   c u r r e n t   u s e r   c a n   p e r f o r m   a n   a c t i o n .   N o t   f i l l i n g   i n   a   s p e c . n a m e s p a c e   m e a n s   " i n   a l l   n a m e s p a c e s " .   S e l f   i s   a   s p e c i a l   c a s e ,   b e c a u s e   u s e r s   s h o u l d   a l w a y s   b e   a b l e   t o   c h e c k   w h e t h e r   t h e y   c a n   p e r f o r m   a n   a c t i o n   a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   S e l f S u b j e c t A c c e s s R e v i e w m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( S e l f S u b j e c t A c c e s s R e v i e w S p e c ) ,   r e q u i r e d S p e c   h o l d s   i n f o r m a t i o n   a b o u t   t h e   r e q u e s t   b e i n g   e v a l u a t e d .   u s e r   a n d   g r o u p s   m u s t   b e   e m p t y s t a t u s   ( S u b j e c t A c c e s s R e v i e w S t a t u s ) S t a t u s   i s   f i l l e d   i n   b y   t h e   s e r v e r   a n d   i n d i c a t e s   w h e t h e r   t h e   r e q u e s t   i s   a l l o w e d   o r   n o t   a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1   k i n d :   S e l f S u b j e c t A c c e s s R e v i e w   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( S e l f S u b j e c t A c c e s s R e v i e w S p e c ) ,   r e q u i r e d   S p e c   h o l d s   i n f o r m a t i o n   a b o u t   t h


Question: What is SelfSubjectAccessReviewSpec?

Answer: S e l f S u b j e c t A c c e s s R e v i e w S p e c   i s   a   d e s c r i p t i o n   o f   t h e   a c c e s s   r e q u e s t .   E x a c t l y   o n e   o f   R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   a n d   N o n R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   m u s t   b e   s e t   n o n R e s o u r c e A t t r i b u t e s   ( N o n R e s o u r c e A t t r i b u t e s ) N o n R e s o u r c e A t t r i b u t e s   d e s c r i b e s   i n f o r m a t i o n   f o r   a   n o n - r e s o u r c e   a c c e s s   r e q u e s t N o n R e s o u r c e A t t r i b u t e s   i n c l u d e s   t h e   a u t h o r i z a t i o n   a t t r i b u t e s   a v a i l a b l e   f o r   n o n - r e s o u r c e   r e q u e s t s   t o   t h e   A u t h o r i z e r   i n t e r f a c e n o n R e s o u r c e A t t r i b u t e s . p a t h   ( s t r i n g ) P a t h   i s   t h e   U R L   p a t h   o f   t h e   r e q u e s t n o n R e s o u r c e A t t r i b u t e s . v e r b   ( s t r i n g ) V e r b   i s   t h e   s t a n d a r d   H T T P   v e r b r e s o u r c e A t t r i b u t e s   ( R e s o u r c e A t t r i b u t e s ) R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   d e s c r i b e s   i n f o r m a t i o n   f o r   a   r e s o u r c e   a c c e s s   r e q u e s t R e s o u r c e A t t r i b u t e s   i n c l u d e s   t h e   a u t h o r i z a t i o n   a t t r i b u t e s   a v a i l a b l e   f o r   r e s o u r c e   r e q u e s t s   t o   t h e   A u t h o r i z e r   i n t e r f a c e r e s o u r c e A t t r i b u t e s . f i e l d S e l e c t o r   ( F i e l d S e l e c t o r A t t r i b u t e s ) f i e l d S e l e c t o r   d e s c r i b e s   t h e   l i m i t a t i o n   o n   a c c e s s   b a s e d   o n   f i e l d .   I t   c a n   o n l y   l i m i t   a c c e s s ,   n o t   b r o a d e n   i t . * F i e l d S e l e c t o r A t t r i b u t e s   i n d i c a t e s   a   f i e l d   l i m i t e d   a


Question: What is HTTP Request?

Answer: P O S T   / a p i s / a u t h o r i z a t i o n . k 8 s . i o / v 1 / s e l f s u b j e c t a c c e s s r e v i e w s


Question: What is Parameters?

Answer: b o d y :   S e l f S u b j e c t A c c e s s R e v i e w ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   S e l f S u b j e c t A c c e s s R e v i e w ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e l f S u b j e c t A c c e s s R e v i e w ) :   O K   2 0 1   ( S e l f S u b j e c t A c c e s s R e v i e w ) :   C r e a t e d   2 0 2   ( S e l f S u b j e c t A c c e s s R e v i e w ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Versions in CustomResourceDefinitions?

Answer: Versions in CustomResourceDefinitionsThis page explains how to add versioning information to CustomResourceDefinitions, to indicate the stability level of your CustomResourceDefinitions or advance your API to a new version with conversion between API representations. It also describes how to upgrade an object from one version to another.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou should have an initial understanding of custom resources.Your Kubernetes server must be at or later than version v1.16.To check the version, enter kubectl version.OverviewThe CustomResourceDefinition API provides a workflow for introducing and upgrading to new versions of a CustomResourceDefinition.When a CustomResourceDefinition is created, the first version is set in the CustomResourceDefinition spec.versions list to an appropriate stability level and a version number. For example v1beta1 would indicate that the first version is not yet stable. All custom resource objects will initially be stored at this version.Once the CustomResourceDefinition is created, clients may begin using the v1beta1 API.Later it might be necessary to add new version such as v1.Adding a new version:Pick a conversion strategy. Since custom resource objects need the ability to be served at both versions, that means they will sometimes be served in a different version than the one stored. To make this possible, the custom resource objects must sometimes be converted between the version they are stored at and the version they are served at. If the conversion involves schema changes and requires custom logic, a conversion webhook should be used. If there are no schema changes, the default None conversion strategy may be used and only the apiVersion field will be modified when serving different versions.If using conversion webhooks, create and deploy the conversion webhook. See the Webhook conversion for more details.Update the CustomResourceDefinition to include the new version in the spec.versions list with served:true. Also, set spec.conversion field to the selected conversion strategy. If using a conversion webhook, configure spec.conversion.webhookClientConfig field to call the webhook.Once the new version is added, clients may incrementally migrate to the new version. It is perfectly safe for some clients to use the old version while others use the new version.Migrate stored objects to the new version:See the upgrade existing objects to a new stored version section.It is safe for clients to use both the old and new version before, during and after upgrading the objects to a new stored version.Removing


Question: How does Versions in CustomResourceDefinitions work?

Answer: Versions in CustomResourceDefinitionsThis page explains how to add versioning information to CustomResourceDefinitions, to indicate the stability level of your CustomResourceDefinitions or advance your API to a new version with conversion between API representations. It also describes how to upgrade an object from one version to another.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou should have an initial understanding of custom resources.Your Kubernetes server must be at or later than version v1.16.To check the version, enter kubectl version.OverviewThe CustomResourceDefinition API provides a workflow for introducing and upgrading to new versions of a CustomResourceDefinition.When a CustomResourceDefinition is created, the first version is set in the CustomResourceDefinition spec.versions list to an appropriate stability level and a version number. For example v1beta1 would indicate that the first version is not yet stable. All custom resource objects will initially be stored at this version.Once the CustomResourceDefinition is created, clients may begin using the v1beta1 API.Later it might be necessary to add new version such as v1.Adding a new version:Pick a conversion strategy. Since custom resource objects need the ability to be served at both versions, that means they will sometimes be served in a different version than the one stored. To make this possible, the custom resource objects must sometimes be converted between the version they are stored at and the version they are served at. If the conversion involves schema changes and requires custom logic, a conversion webhook should be used. If there are no schema changes, the default None conversion strategy may be used and only the apiVersion field will be modified when serving different versions.If using conversion webhooks, create and deploy the conversion webhook. See the Webhook conversion for more details.Update the CustomResourceDefinition to include the new version in the spec.versions list with served:true. Also, set spec.conversion field to the selected conversion strategy. If using a conversion webhook, configure spec.conversion.webhookClientConfig field to call the webhook.Once the new version is added, clients may incrementally migrate to the new version. It is perfectly safe for some clients to use the old version while others use the new version.Migrate stored objects to the new version:See the upgrade existing objects to a new stored version section.It is safe for clients to use both the old and new version before, during and after upgrading the objects to a new stored version.Removing


Question: When would you use Versions in CustomResourceDefinitions?

Answer: Versions in CustomResourceDefinitionsThis page explains how to add versioning information to CustomResourceDefinitions, to indicate the stability level of your CustomResourceDefinitions or advance your API to a new version with conversion between API representations. It also describes how to upgrade an object from one version to another.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou should have an initial understanding of custom resources.Your Kubernetes server must be at or later than version v1.16.To check the version, enter kubectl version.OverviewThe CustomResourceDefinition API provides a workflow for introducing and upgrading to new versions of a CustomResourceDefinition.When a CustomResourceDefinition is created, the first version is set in the CustomResourceDefinition spec.versions list to an appropriate stability level and a version number. For example v1beta1 would indicate that the first version is not yet stable. All custom resource objects will initially be stored at this version.Once the CustomResourceDefinition is created, clients may begin using the v1beta1 API.Later it might be necessary to add new version such as v1.Adding a new version:Pick a conversion strategy. Since custom resource objects need the ability to be served at both versions, that means they will sometimes be served in a different version than the one stored. To make this possible, the custom resource objects must sometimes be converted between the version they are stored at and the version they are served at. If the conversion involves schema changes and requires custom logic, a conversion webhook should be used. If there are no schema changes, the default None conversion strategy may be used and only the apiVersion field will be modified when serving different versions.If using conversion webhooks, create and deploy the conversion webhook. See the Webhook conversion for more details.Update the CustomResourceDefinition to include the new version in the spec.versions list with served:true. Also, set spec.conversion field to the selected conversion strategy. If using a conversion webhook, configure spec.conversion.webhookClientConfig field to call the webhook.Once the new version is added, clients may incrementally migrate to the new version. It is perfectly safe for some clients to use the old version while others use the new version.Migrate stored objects to the new version:See the upgrade existing objects to a new stored version section.It is safe for clients to use both the old and new version before, during and after upgrading the objects to a new stored version.Removing


Question: What are the benefits of Versions in CustomResourceDefinitions?

Answer: Versions in CustomResourceDefinitionsThis page explains how to add versioning information to CustomResourceDefinitions, to indicate the stability level of your CustomResourceDefinitions or advance your API to a new version with conversion between API representations. It also describes how to upgrade an object from one version to another.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou should have an initial understanding of custom resources.Your Kubernetes server must be at or later than version v1.16.To check the version, enter kubectl version.OverviewThe CustomResourceDefinition API provides a workflow for introducing and upgrading to new versions of a CustomResourceDefinition.When a CustomResourceDefinition is created, the first version is set in the CustomResourceDefinition spec.versions list to an appropriate stability level and a version number. For example v1beta1 would indicate that the first version is not yet stable. All custom resource objects will initially be stored at this version.Once the CustomResourceDefinition is created, clients may begin using the v1beta1 API.Later it might be necessary to add new version such as v1.Adding a new version:Pick a conversion strategy. Since custom resource objects need the ability to be served at both versions, that means they will sometimes be served in a different version than the one stored. To make this possible, the custom resource objects must sometimes be converted between the version they are stored at and the version they are served at. If the conversion involves schema changes and requires custom logic, a conversion webhook should be used. If there are no schema changes, the default None conversion strategy may be used and only the apiVersion field will be modified when serving different versions.If using conversion webhooks, create and deploy the conversion webhook. See the Webhook conversion for more details.Update the CustomResourceDefinition to include the new version in the spec.versions list with served:true. Also, set spec.conversion field to the selected conversion strategy. If using a conversion webhook, configure spec.conversion.webhookClientConfig field to call the webhook.Once the new version is added, clients may incrementally migrate to the new version. It is perfectly safe for some clients to use the old version while others use the new version.Migrate stored objects to the new version:See the upgrade existing objects to a new stored version section.It is safe for clients to use both the old and new version before, during and after upgrading the objects to a new stored version.Removing


Question: What is Versions in CustomResourceDefinitions?

Answer: T h i s   p a g e   e x p l a i n s   h o w   t o   a d d   v e r s i o n i n g   i n f o r m a t i o n   t o   C u s t o m R e s o u r c e D e f i n i t i o n s ,   t o   i n d i c a t e   t h e   s t a b i l i t y   l e v e l   o f   y o u r   C u s t o m R e s o u r c e D e f i n i t i o n s   o r   a d v a n c e   y o u r   A P I   t o   a   n e w   v e r s i o n   w i t h   c o n v e r s i o n   b e t w e e n   A P I   r e p r e s e n t a t i o n s .   I t   a l s o   d e s c r i b e s   h o w   t o   u p g r a d e   a n   o b j e c t   f r o m   o n e   v e r s i o n   t o   a n o t h e r .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   Y o u   s h o u l d   h a v e   a n   i n i t i a l   u n d e r s t a n d i n g   o f   c u s t o m   r e s o u r c e s .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Overview?

Answer: T h e   C u s t o m R e s o u r c e D e f i n i t i o n   A P I   p r o v i d e s   a   w o r k f l o w   f o r   i n t r o d u c i n g   a n d   u p g r a d i n g   t o   n e w   v e r s i o n s   o f   a   C u s t o m R e s o u r c e D e f i n i t i o n .   W h e n   a   C u s t o m R e s o u r c e D e f i n i t i o n   i s   c r e a t e d ,   t h e   f i r s t   v e r s i o n   i s   s e t   i n   t h e   C u s t o m R e s o u r c e D e f i n i t i o n   s p e c . v e r s i o n s   l i s t   t o   a n   a p p r o p r i a t e   s t a b i l i t y   l e v e l   a n d   a   v e r s i o n   n u m b e r .   F o r   e x a m p l e   v 1 b e t a 1   w o u l d   i n d i c a t e   t h a t   t h e   f i r s t   v e r s i o n   i s   n o t   y e t   s t a b l e .   A l l   c u s t o m   r e s o u r c e   o b j e c t s   w i l l   i n i t i a l l y   b e   s t o r e d   a t   t h i s   v e r s i o n .   O n c e   t h e   C u s t o m R e s o u r c e D e f i n i t i o n   i s   c r e a t e d ,   c l i e n t s   m a y   b e g i n   u s i n g   t h e   v 1 b e t a 1   A P I .   L a t e r   i t   m i g h t   b e   n e c e s s a r y   t o   a d d   n e w   v e r s i o n   s u c h   a s   v 1 .   A d d i n g   a   n e w   v e r s i o n :   P i c k   a   c o n v e r s i o n   s t r a t e g y .   S i n c e   c u s t o m   r e s o u r c e   o b j e c t s   n e e d   t h e   a b i l i t y   t o   b e   s e r v e d   a t   b o t h   v e r s i o n s ,   t h a t   m e a n s   t h e y   w i l l   s o m e t i m e s   b e   s e r v e d   i n   a   d i f f e r e n t   v e r s i o n   t h a n   t h e   o n e   s t o r e d .   T o   m a k e   t h i s   p o s s i b l e ,   t h e   c u s t o m   r e s o u r c e   o b j e c t s   m u s t   s o m e t i m e s   b e   c o n v e r t e d   b e t w e e n   t h e   v e r s i o n   t h e y   a r e   s t o r e d   a t   a n d   t h e   v e r s i o n   t h e y   a r e   s e r v e d   a t .   I f   t h e   c o n v e r s i o n   i n v o l v e s   s c h e m a


Question: What is Specify multiple versions?

Answer: T h e   C u s t o m R e s o u r c e D e f i n i t i o n   A P I   v e r s i o n s   f i e l d   c a n   b e   u s e d   t o   s u p p o r t   m u l t i p l e   v e r s i o n s   o f   c u s t o m   r e s o u r c e s   t h a t   y o u   h a v e   d e v e l o p e d .   V e r s i o n s   c a n   h a v e   d i f f e r e n t   s c h e m a s ,   a n d   c o n v e r s i o n   w e b h o o k s   c a n   c o n v e r t   c u s t o m   r e s o u r c e s   b e t w e e n   v e r s i o n s .   W e b h o o k   c o n v e r s i o n s   s h o u l d   f o l l o w   t h e   K u b e r n e t e s   A P I   c o n v e n t i o n s   w h e r e v e r   a p p l i c a b l e .   S p e c i f i c a l l y ,   S e e   t h e   A P I   c h a n g e   d o c u m e n t a t i o n   f o r   a   s e t   o f   u s e f u l   g o t c h a s   a n d   s u g g e s t i o n s .


Question: What is Note:?

Answer: T h i s   e x a m p l e   s h o w s   a   C u s t o m R e s o u r c e D e f i n i t i o n   w i t h   t w o   v e r s i o n s .   F o r   t h e   f i r s t   e x a m p l e ,   t h e   a s s u m p t i o n   i s   a l l   v e r s i o n s   s h a r e   t h e   s a m e   s c h e m a   w i t h   n o   c o n v e r s i o n   b e t w e e n   t h e m .   T h e   c o m m e n t s   i n   t h e   Y A M L   p r o v i d e   m o r e   c o n t e x t .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   m e t a d a t a :   #   n a m e   m u s t   m a t c h   t h e   s p e c   f i e l d s   b e l o w ,   a n d   b e   i n   t h e   f o r m :   < p l u r a l > . < g r o u p >   n a m e :   c r o n t a b s . e x a m p l e . c o m   s p e c :   #   g r o u p   n a m e   t o   u s e   f o r   R E S T   A P I :   / a p i s / < g r o u p > / < v e r s i o n >   g r o u p :   e x a m p l e . c o m   #   l i s t   o f   v e r s i o n s   s u p p o r t e d   b y   t h i s   C u s t o m R e s o u r c e D e f i n i t i o n   v e r s i o n s :   -   n a m e :   v 1 b e t a 1   #   E a c h   v e r s i o n   c a n   b e   e n a b l e d / d i s a b l e d   b y   S e r v e d   f l a g .   s e r v e d :   t r u e   #   O n e   a n d   o n l y   o n e   v e r s i o n   m u s t   b e   m a r k e d   a s   t h e   s t o r a g e   v e r s i o n .   s t o r a g e :   t r u e   #   A   s c h e m a   i s   r e q u i r e d   s c h e m a :   o p e n A P I V 3 S c h e m a :   t y p e :   o b j e c t   p r o p e r t i e s :   h o s t :   t y p e :   s t r i n g   p o r t :   t y p e :   s t r i n g   -   n a m e :   v 1   s e r v e d :   t r u e   s t o r a g e :   f a l s e   s c h e m a :   o p e n A P I V 3 S c h e m a :   t y p e :   o b j e c t   p r o p e r t i e s :   h o s t :   t y p e :   s t r i n g   p o r t :   t y p e :   s t r i n g   #   T h e   c o n v e r s i o n   s e c t i o n   i s   i n t r o d u c e d   i


Question: What is Version priority?

Answer: R e g a r d l e s s   o f   t h e   o r d e r   i n   w h i c h   v e r s i o n s   a r e   d e f i n e d   i n   a   C u s t o m R e s o u r c e D e f i n i t i o n ,   t h e   v e r s i o n   w i t h   t h e   h i g h e s t   p r i o r i t y   i s   u s e d   b y   k u b e c t l   a s   t h e   d e f a u l t   v e r s i o n   t o   a c c e s s   o b j e c t s .   T h e   p r i o r i t y   i s   d e t e r m i n e d   b y   p a r s i n g   t h e   n a m e   f i e l d   t o   d e t e r m i n e   t h e   v e r s i o n   n u m b e r ,   t h e   s t a b i l i t y   ( G A ,   B e t a ,   o r   A l p h a ) ,   a n d   t h e   s e q u e n c e   w i t h i n   t h a t   s t a b i l i t y   l e v e l .   T h e   a l g o r i t h m   u s e d   f o r   s o r t i n g   t h e   v e r s i o n s   i s   d e s i g n e d   t o   s o r t   v e r s i o n s   i n   t h e   s a m e   w a y   t h a t   t h e   K u b e r n e t e s   p r o j e c t   s o r t s   K u b e r n e t e s   v e r s i o n s .   V e r s i o n s   s t a r t   w i t h   a   v   f o l l o w e d   b y   a   n u m b e r ,   a n   o p t i o n a l   b e t a   o r   a l p h a   d e s i g n a t i o n ,   a n d   o p t i o n a l   a d d i t i o n a l   n u m e r i c   v e r s i o n i n g   i n f o r m a t i o n .   B r o a d l y ,   a   v e r s i o n   s t r i n g   m i g h t   l o o k   l i k e   v 2   o r   v 2 b e t a 1 .   V e r s i o n s   a r e   s o r t e d   u s i n g   t h e   f o l l o w i n g   a l g o r i t h m :   E n t r i e s   t h a t   f o l l o w   K u b e r n e t e s   v e r s i o n   p a t t e r n s   a r e   s o r t e d   b e f o r e   t h o s e   t h a t   d o   n o t . F o r   e n t r i e s   t h a t   f o l l o w   K u b e r n e t e s   v e r s i o n   p a t t e r n s ,   t h e   n u m e r i c   p o r t i o n s   o f   t h e   v e r s i o n   s t r i n g   i s   s o r t e d   l a r g e s t   t o   s m a l l e s t . I f   t h e   s t r i n g s   b e t a   o r   a l p h a   f o l l o w   t h e   f i r s t


Question: What is Version deprecation?

Answer: S t a r t i n g   i n   v 1 . 1 9 ,   a   C u s t o m R e s o u r c e D e f i n i t i o n   c a n   i n d i c a t e   a   p a r t i c u l a r   v e r s i o n   o f   t h e   r e s o u r c e   i t   d e f i n e s   i s   d e p r e c a t e d .   W h e n   A P I   r e q u e s t s   t o   a   d e p r e c a t e d   v e r s i o n   o f   t h a t   r e s o u r c e   a r e   m a d e ,   a   w a r n i n g   m e s s a g e   i s   r e t u r n e d   i n   t h e   A P I   r e s p o n s e   a s   a   h e a d e r .   T h e   w a r n i n g   m e s s a g e   f o r   e a c h   d e p r e c a t e d   v e r s i o n   o f   t h e   r e s o u r c e   c a n   b e   c u s t o m i z e d   i f   d e s i r e d .   A   c u s t o m i z e d   w a r n i n g   m e s s a g e   s h o u l d   i n d i c a t e   t h e   d e p r e c a t e d   A P I   g r o u p ,   v e r s i o n ,   a n d   k i n d ,   a n d   s h o u l d   i n d i c a t e   w h a t   A P I   g r o u p ,   v e r s i o n ,   a n d   k i n d   s h o u l d   b e   u s e d   i n s t e a d ,   i f   a p p l i c a b l e .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   n a m e :   c r o n t a b s . e x a m p l e . c o m   s p e c :   g r o u p :   e x a m p l e . c o m   n a m e s :   p l u r a l :   c r o n t a b s   s i n g u l a r :   c r o n t a b   k i n d :   C r o n T a b   s c o p e :   N a m e s p a c e d   v e r s i o n s :   -   n a m e :   v 1 a l p h a 1   s e r v e d :   t r u e   s t o r a g e :   f a l s e   #   T h i s   i n d i c a t e s   t h e   v 1 a l p h a 1   v e r s i o n   o f   t h e   c u s t o m   r e s o u r c e   i s   d e p r e c a t e d .   #   A P I   r e q u e s t s   t o   t h i s   v e r s i o n   r e c e i v e   a   w a r n i n g   h e a d e r   i n   t h e   s e r v e r   r e s p o n s e .   d e p r e c a t e d :   t r u e   #   T h i s   o v e r r i d e s   t h e   d e f a u l t   w a r n i n g   r e t u r n e d   t o


Question: What is Version removal?

Answer: A n   o l d e r   A P I   v e r s i o n   c a n n o t   b e   d r o p p e d   f r o m   a   C u s t o m R e s o u r c e D e f i n i t i o n   m a n i f e s t   u n t i l   e x i s t i n g   s t o r e d   d a t a   h a s   b e e n   m i g r a t e d   t o   t h e   n e w e r   A P I   v e r s i o n   f o r   a l l   c l u s t e r s   t h a t   s e r v e d   t h e   o l d e r   v e r s i o n   o f   t h e   c u s t o m   r e s o u r c e ,   a n d   t h e   o l d   v e r s i o n   i s   r e m o v e d   f r o m   t h e   s t a t u s . s t o r e d V e r s i o n s   o f   t h e   C u s t o m R e s o u r c e D e f i n i t i o n .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   n a m e :   c r o n t a b s . e x a m p l e . c o m   s p e c :   g r o u p :   e x a m p l e . c o m   n a m e s :   p l u r a l :   c r o n t a b s   s i n g u l a r :   c r o n t a b   k i n d :   C r o n T a b   s c o p e :   N a m e s p a c e d   v e r s i o n s :   -   n a m e :   v 1 b e t a 1   #   T h i s   i n d i c a t e s   t h e   v 1 b e t a 1   v e r s i o n   o f   t h e   c u s t o m   r e s o u r c e   i s   n o   l o n g e r   s e r v e d .   #   A P I   r e q u e s t s   t o   t h i s   v e r s i o n   r e c e i v e   a   n o t   f o u n d   e r r o r   i n   t h e   s e r v e r   r e s p o n s e .   s e r v e d :   f a l s e   s c h e m a :   . . .   -   n a m e :   v 1   s e r v e d :   t r u e   #   T h e   n e w   s e r v e d   v e r s i o n   s h o u l d   b e   s e t   a s   t h e   s t o r a g e   v e r s i o n   s t o r a g e :   t r u e   s c h e m a :   . . .


Question: What is Note:?

Answer: T h e   a b o v e   e x a m p l e   h a s   a   N o n e   c o n v e r s i o n   b e t w e e n   v e r s i o n s   w h i c h   o n l y   s e t s   t h e   a p i V e r s i o n   f i e l d   o n   c o n v e r s i o n   a n d   d o e s   n o t   c h a n g e   t h e   r e s t   o f   t h e   o b j e c t .   T h e   A P I   s e r v e r   a l s o   s u p p o r t s   w e b h o o k   c o n v e r s i o n s   t h a t   c a l l   a n   e x t e r n a l   s e r v i c e   i n   c a s e   a   c o n v e r s i o n   i s   r e q u i r e d .   F o r   e x a m p l e   w h e n :   c u s t o m   r e s o u r c e   i s   r e q u e s t e d   i n   a   d i f f e r e n t   v e r s i o n   t h a n   s t o r e d   v e r s i o n . W a t c h   i s   c r e a t e d   i n   o n e   v e r s i o n   b u t   t h e   c h a n g e d   o b j e c t   i s   s t o r e d   i n   a n o t h e r   v e r s i o n . c u s t o m   r e s o u r c e   P U T   r e q u e s t   i s   i n   a   d i f f e r e n t   v e r s i o n   t h a n   s t o r a g e   v e r s i o n .   T o   c o v e r   a l l   o f   t h e s e   c a s e s   a n d   t o   o p t i m i z e   c o n v e r s i o n   b y   t h e   A P I   s e r v e r ,   t h e   c o n v e r s i o n   r e q u e s t s   m a y   c o n t a i n   m u l t i p l e   o b j e c t s   i n   o r d e r   t o   m i n i m i z e   t h e   e x t e r n a l   c a l l s .   T h e   w e b h o o k   s h o u l d   p e r f o r m   t h e s e   c o n v e r s i o n s   i n d e p e n d e n t l y .


Question: What is Write a conversion webhook server?

Answer: P l e a s e   r e f e r   t o   t h e   i m p l e m e n t a t i o n   o f   t h e   c u s t o m   r e s o u r c e   c o n v e r s i o n   w e b h o o k   s e r v e r   t h a t   i s   v a l i d a t e d   i n   a   K u b e r n e t e s   e 2 e   t e s t .   T h e   w e b h o o k   h a n d l e s   t h e   C o n v e r s i o n R e v i e w   r e q u e s t s   s e n t   b y   t h e   A P I   s e r v e r s ,   a n d   s e n d s   b a c k   c o n v e r s i o n   r e s u l t s   w r a p p e d   i n   C o n v e r s i o n R e s p o n s e .   N o t e   t h a t   t h e   r e q u e s t   c o n t a i n s   a   l i s t   o f   c u s t o m   r e s o u r c e s   t h a t   n e e d   t o   b e   c o n v e r t e d   i n d e p e n d e n t l y   w i t h o u t   c h a n g i n g   t h e   o r d e r   o f   o b j e c t s .   T h e   e x a m p l e   s e r v e r   i s   o r g a n i z e d   i n   a   w a y   t o   b e   r e u s e d   f o r   o t h e r   c o n v e r s i o n s .   M o s t   o f   t h e   c o m m o n   c o d e   a r e   l o c a t e d   i n   t h e   f r a m e w o r k   f i l e   t h a t   l e a v e s   o n l y   o n e   f u n c t i o n   t o   b e   i m p l e m e n t e d   f o r   d i f f e r e n t   c o n v e r s i o n s .


Question: What is Permissible mutations?

Answer: A   c o n v e r s i o n   w e b h o o k   m u s t   n o t   m u t a t e   a n y t h i n g   i n s i d e   o f   m e t a d a t a   o f   t h e   c o n v e r t e d   o b j e c t   o t h e r   t h a n   l a b e l s   a n d   a n n o t a t i o n s .   A t t e m p t e d   c h a n g e s   t o   n a m e ,   U I D   a n d   n a m e s p a c e   a r e   r e j e c t e d   a n d   f a i l   t h e   r e q u e s t   w h i c h   c a u s e d   t h e   c o n v e r s i o n .   A l l   o t h e r   c h a n g e s   a r e   i g n o r e d .


Question: What is Deploy the conversion webhook service?

Answer: D o c u m e n t a t i o n   f o r   d e p l o y i n g   t h e   c o n v e r s i o n   w e b h o o k   i s   t h e   s a m e   a s   f o r   t h e   a d m i s s i o n   w e b h o o k   e x a m p l e   s e r v i c e .   T h e   a s s u m p t i o n   f o r   n e x t   s e c t i o n s   i s   t h a t   t h e   c o n v e r s i o n   w e b h o o k   s e r v e r   i s   d e p l o y e d   t o   a   s e r v i c e   n a m e d   e x a m p l e - c o n v e r s i o n - w e b h o o k - s e r v e r   i n   d e f a u l t   n a m e s p a c e   a n d   s e r v i n g   t r a f f i c   o n   p a t h   / c r d c o n v e r t .


Question: What is Configure CustomResourceDefinition to use conversion webhooks?

Answer: T h e   N o n e   c o n v e r s i o n   e x a m p l e   c a n   b e   e x t e n d e d   t o   u s e   t h e   c o n v e r s i o n   w e b h o o k   b y   m o d i f y i n g   c o n v e r s i o n   s e c t i o n   o f   t h e   s p e c :   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   m e t a d a t a :   #   n a m e   m u s t   m a t c h   t h e   s p e c   f i e l d s   b e l o w ,   a n d   b e   i n   t h e   f o r m :   < p l u r a l > . < g r o u p >   n a m e :   c r o n t a b s . e x a m p l e . c o m   s p e c :   #   g r o u p   n a m e   t o   u s e   f o r   R E S T   A P I :   / a p i s / < g r o u p > / < v e r s i o n >   g r o u p :   e x a m p l e . c o m   #   l i s t   o f   v e r s i o n s   s u p p o r t e d   b y   t h i s   C u s t o m R e s o u r c e D e f i n i t i o n   v e r s i o n s :   -   n a m e :   v 1 b e t a 1   #   E a c h   v e r s i o n   c a n   b e   e n a b l e d / d i s a b l e d   b y   S e r v e d   f l a g .   s e r v e d :   t r u e   #   O n e   a n d   o n l y   o n e   v e r s i o n   m u s t   b e   m a r k e d   a s   t h e   s t o r a g e   v e r s i o n .   s t o r a g e :   t r u e   #   E a c h   v e r s i o n   c a n   d e f i n e   i t s   o w n   s c h e m a   w h e n   t h e r e   i s   n o   t o p - l e v e l   #   s c h e m a   i s   d e f i n e d .   s c h e m a :   o p e n A P I V 3 S c h e m a :   t y p e :   o b j e c t   p r o p e r t i e s :   h o s t P o r t :   t y p e :   s t r i n g   -   n a m e :   v 1   s e r v e d :   t r u e   s t o r a g e :   f a l s e   s c h e m a :   o p e n A P I V 3 S c h e m a :   t y p e :   o b j e c t   p r o p e r t i e s :   h o s t :   t y p e :   s t r i n g   p o r t :   t y p e :   s t r i n g   c o n v e r s i o n :   #   t h e   W e b h o o k   s t r a t e g y   i n s t r u c t s   t h e   A P I   s e r v e r   t o   c a l l   a n   e x t e r n a l   w e b h o o k   f o r


Question: What is Contacting the webhook?

Answer: O n c e   t h e   A P I   s e r v e r   h a s   d e t e r m i n e d   a   r e q u e s t   s h o u l d   b e   s e n t   t o   a   c o n v e r s i o n   w e b h o o k ,   i t   n e e d s   t o   k n o w   h o w   t o   c o n t a c t   t h e   w e b h o o k .   T h i s   i s   s p e c i f i e d   i n   t h e   w e b h o o k C l i e n t C o n f i g   s t a n z a   o f   t h e   w e b h o o k   c o n f i g u r a t i o n .   C o n v e r s i o n   w e b h o o k s   c a n   e i t h e r   b e   c a l l e d   v i a   a   U R L   o r   a   s e r v i c e   r e f e r e n c e ,   a n d   c a n   o p t i o n a l l y   i n c l u d e   a   c u s t o m   C A   b u n d l e   t o   u s e   t o   v e r i f y   t h e   T L S   c o n n e c t i o n .


Question: What is URL?

Answer: u r l   g i v e s   t h e   l o c a t i o n   o f   t h e   w e b h o o k ,   i n   s t a n d a r d   U R L   f o r m   ( s c h e m e : / / h o s t : p o r t / p a t h ) .   T h e   h o s t   s h o u l d   n o t   r e f e r   t o   a   s e r v i c e   r u n n i n g   i n   t h e   c l u s t e r ;   u s e   a   s e r v i c e   r e f e r e n c e   b y   s p e c i f y i n g   t h e   s e r v i c e   f i e l d   i n s t e a d .   T h e   h o s t   m i g h t   b e   r e s o l v e d   v i a   e x t e r n a l   D N S   i n   s o m e   a p i s e r v e r s   ( i . e . ,   k u b e - a p i s e r v e r   c a n n o t   r e s o l v e   i n - c l u s t e r   D N S   a s   t h a t   w o u l d   b e   a   l a y e r i n g   v i o l a t i o n ) .   h o s t   m a y   a l s o   b e   a n   I P   a d d r e s s .   P l e a s e   n o t e   t h a t   u s i n g   l o c a l h o s t   o r   1 2 7 . 0 . 0 . 1   a s   a   h o s t   i s   r i s k y   u n l e s s   y o u   t a k e   g r e a t   c a r e   t o   r u n   t h i s   w e b h o o k   o n   a l l   h o s t s   w h i c h   r u n   a n   a p i s e r v e r   w h i c h   m i g h t   n e e d   t o   m a k e   c a l l s   t o   t h i s   w e b h o o k .   S u c h   i n s t a l l a t i o n s   a r e   l i k e l y   t o   b e   n o n - p o r t a b l e   o r   n o t   r e a d i l y   r u n   i n   a   n e w   c l u s t e r .   T h e   s c h e m e   m u s t   b e   " h t t p s " ;   t h e   U R L   m u s t   b e g i n   w i t h   " h t t p s : / / " .   A t t e m p t i n g   t o   u s e   a   u s e r   o r   b a s i c   a u t h   ( f o r   e x a m p l e   " u s e r : p a s s w o r d @ " )   i s   n o t   a l l o w e d .   F r a g m e n t s   ( " # . . . " )   a n d   q u e r y   p a r a m e t e r s   ( " ? . . . " )   a r e   a l s o   n o t   a l l o w e d .   H e r e   i s   a n   e x a m p l e   o f   a   c o n v e r s i o n   w e b h o o k   c o n f i g u r e d   t o   c a l l   a   U R L   ( a n d   e x p e c t s   t h e   T L S   c e r t i f


Question: What is Service Reference?

Answer: T h e   s e r v i c e   s t a n z a   i n s i d e   w e b h o o k C l i e n t C o n f i g   i s   a   r e f e r e n c e   t o   t h e   s e r v i c e   f o r   a   c o n v e r s i o n   w e b h o o k .   I f   t h e   w e b h o o k   i s   r u n n i n g   w i t h i n   t h e   c l u s t e r ,   t h e n   y o u   s h o u l d   u s e   s e r v i c e   i n s t e a d   o f   u r l .   T h e   s e r v i c e   n a m e s p a c e   a n d   n a m e   a r e   r e q u i r e d .   T h e   p o r t   i s   o p t i o n a l   a n d   d e f a u l t s   t o   4 4 3 .   T h e   p a t h   i s   o p t i o n a l   a n d   d e f a u l t s   t o   " / " .   H e r e   i s   a n   e x a m p l e   o f   a   w e b h o o k   t h a t   i s   c o n f i g u r e d   t o   c a l l   a   s e r v i c e   o n   p o r t   " 1 2 3 4 "   a t   t h e   s u b p a t h   " / m y - p a t h " ,   a n d   t o   v e r i f y   t h e   T L S   c o n n e c t i o n   a g a i n s t   t h e   S e r v e r N a m e   m y - s e r v i c e - n a m e . m y - s e r v i c e - n a m e s p a c e . s v c   u s i n g   a   c u s t o m   C A   b u n d l e .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   . . .   s p e c :   . . .   c o n v e r s i o n :   s t r a t e g y :   W e b h o o k   w e b h o o k :   c l i e n t C o n f i g :   s e r v i c e :   n a m e s p a c e :   m y - s e r v i c e - n a m e s p a c e   n a m e :   m y - s e r v i c e - n a m e   p a t h :   / m y - p a t h   p o r t :   1 2 3 4   c a B u n d l e :   " C i 0 t L S 0 t Q k . . . < b a s e 6 4 - e n c o d e d   P E M   b u n d l e > . . . t L S 0 K "   . . .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   . . .   s p e c :   . . .   c o n v e r s i o n :   s t r a t e g y :   W e b h o o k   w e b h o o k :   c l i e n t C o n f i g :   s e r v i c e :   n a m e s p a c e :   m y -


Question: What is Request?

Answer: W e b h o o k s   a r e   s e n t   a   P O S T   r e q u e s t ,   w i t h   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n ,   w i t h   a   C o n v e r s i o n R e v i e w   A P I   o b j e c t   i n   t h e   a p i e x t e n s i o n s . k 8 s . i o   A P I   g r o u p   s e r i a l i z e d   t o   J S O N   a s   t h e   b o d y .   W e b h o o k s   c a n   s p e c i f y   w h a t   v e r s i o n s   o f   C o n v e r s i o n R e v i e w   o b j e c t s   t h e y   a c c e p t   w i t h   t h e   c o n v e r s i o n R e v i e w V e r s i o n s   f i e l d   i n   t h e i r   C u s t o m R e s o u r c e D e f i n i t i o n :   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   . . .   s p e c :   . . .   c o n v e r s i o n :   s t r a t e g y :   W e b h o o k   w e b h o o k :   c o n v e r s i o n R e v i e w V e r s i o n s :   [ " v 1 " ,   " v 1 b e t a 1 " ]   . . .   c o n v e r s i o n R e v i e w V e r s i o n s   i s   a   r e q u i r e d   f i e l d   w h e n   c r e a t i n g   a p i e x t e n s i o n s . k 8 s . i o / v 1   c u s t o m   r e s o u r c e   d e f i n i t i o n s .   W e b h o o k s   a r e   r e q u i r e d   t o   s u p p o r t   a t   l e a s t   o n e   C o n v e r s i o n R e v i e w   v e r s i o n   u n d e r s t o o d   b y   t h e   c u r r e n t   a n d   p r e v i o u s   A P I   s e r v e r .   a p i V e r s i o n :   a p i e x t e n s i o n s . k 8 s . i o / v 1   k i n d :   C u s t o m R e s o u r c e D e f i n i t i o n   . . .   s p e c :   . . .   c o n v e r s i o n :   s t r a t e g y :   W e b h o o k   w e b h o o k :   c o n v e r s i o n R e v i e w V e r s i o n s :   [ " v 1 " ,   " v 1 b e t a 1 " ]   . . .   c o n v e r s i o n R e v i e w V e r s i o n s   i s   a   r e q u i r e d   f i e l d   w h e n   c r e a t i n g   a p i e x t e n s i o n s . k 8 s . i o / v 1   c u s t o m   r e s o u r c e   d e f i n


Question: What is Response?

Answer: W e b h o o k s   r e s p o n d   w i t h   a   2 0 0   H T T P   s t a t u s   c o d e ,   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n ,   a n d   a   b o d y   c o n t a i n i n g   a   C o n v e r s i o n R e v i e w   o b j e c t   ( i n   t h e   s a m e   v e r s i o n   t h e y   w e r e   s e n t ) ,   w i t h   t h e   r e s p o n s e   s t a n z a   p o p u l a t e d ,   s e r i a l i z e d   t o   J S O N .   I f   c o n v e r s i o n   s u c c e e d s ,   a   w e b h o o k   s h o u l d   r e t u r n   a   r e s p o n s e   s t a n z a   c o n t a i n i n g   t h e   f o l l o w i n g   f i e l d s :   u i d ,   c o p i e d   f r o m   t h e   r e q u e s t . u i d   s e n t   t o   t h e   w e b h o o k r e s u l t ,   s e t   t o   { " s t a t u s " : " S u c c e s s " } c o n v e r t e d O b j e c t s ,   c o n t a i n i n g   a l l   o f   t h e   o b j e c t s   f r o m   r e q u e s t . o b j e c t s ,   c o n v e r t e d   t o   r e q u e s t . d e s i r e d A P I V e r s i o n   E x a m p l e   o f   a   m i n i m a l   s u c c e s s f u l   r e s p o n s e   f r o m   a   w e b h o o k :   {   " a p i V e r s i o n " :   " a p i e x t e n s i o n s . k 8 s . i o / v 1 " ,   " k i n d " :   " C o n v e r s i o n R e v i e w " ,   " r e s p o n s e " :   {   #   m u s t   m a t c h   < r e q u e s t . u i d >   " u i d " :   " 7 0 5 a b 4 f 5 - 6 3 9 3 - 1 1 e 8 - b 7 c c - 4 2 0 1 0 a 8 0 0 0 0 2 " ,   " r e s u l t " :   {   " s t a t u s " :   " S u c c e s s "   } ,   #   O b j e c t s   m u s t   m a t c h   t h e   o r d e r   o f   r e q u e s t . o b j e c t s ,   a n d   h a v e   a p i V e r s i o n   s e t   t o   < r e q u e s t . d e s i r e d A P I V e r s i o n > .   #   k i n d ,   m e t a d a t a . u i d ,   m e t a d a t a . n a m e ,   a n d   m e t a d a t a . n a m e s p a c e   f i e l d s   m u s t   n o t   b e   c h a n g e d   b y   t h e   w e b h o o k .   #   m e t a d a t a . l a b e l s   a n d   m e


Question: What is Warning:?

Answer: E x a m p l e   o f   a   r e s p o n s e   f r o m   a   w e b h o o k   i n d i c a t i n g   a   c o n v e r s i o n   r e q u e s t   f a i l e d ,   w i t h   a n   o p t i o n a l   m e s s a g e : {   " a p i V e r s i o n " :   " a p i e x t e n s i o n s . k 8 s . i o / v 1 " ,   " k i n d " :   " C o n v e r s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " r e s u l t " :   {   " s t a t u s " :   " F a i l e d " ,   " m e s s a g e " :   " h o s t P o r t   c o u l d   n o t   b e   p a r s e d   i n t o   a   s e p a r a t e   h o s t   a n d   p o r t "   }   }   }   {   #   D e p r e c a t e d   i n   v 1 . 1 6   i n   f a v o r   o f   a p i e x t e n s i o n s . k 8 s . i o / v 1   " a p i V e r s i o n " :   " a p i e x t e n s i o n s . k 8 s . i o / v 1 b e t a 1 " ,   " k i n d " :   " C o n v e r s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " r e s u l t " :   {   " s t a t u s " :   " F a i l e d " ,   " m e s s a g e " :   " h o s t P o r t   c o u l d   n o t   b e   p a r s e d   i n t o   a   s e p a r a t e   h o s t   a n d   p o r t "   }   }   }   {   " a p i V e r s i o n " :   " a p i e x t e n s i o n s . k 8 s . i o / v 1 " ,   " k i n d " :   " C o n v e r s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " r e s u l t " :   {   " s t a t u s " :   " F a i l e d " ,   " m e s s a g e " :   " h o s t P o r t   c o u l d   n o t   b e   p a r s e d   i n t o   a   s e p a r a t e   h o s t   a n d   p o r t "   }   }   }   {   " a p i V e r s i o n " :   " a p i e x t e n s i o n s . k 8 s . i o / v 1 " ,   " k i n d " :   " C o n v e r s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " r e s u l t " :   {   " s t a t u s " :   " F a


Question: What is Writing, reading, and updating versioned CustomResourceDefinition objects?

Answer: W h e n   a n   o b j e c t   i s   w r i t t e n ,   i t   i s   s t o r e d   a t   t h e   v e r s i o n   d e s i g n a t e d   a s   t h e   s t o r a g e   v e r s i o n   a t   t h e   t i m e   o f   t h e   w r i t e .   I f   t h e   s t o r a g e   v e r s i o n   c h a n g e s ,   e x i s t i n g   o b j e c t s   a r e   n e v e r   c o n v e r t e d   a u t o m a t i c a l l y .   H o w e v e r ,   n e w l y - c r e a t e d   o r   u p d a t e d   o b j e c t s   a r e   w r i t t e n   a t   t h e   n e w   s t o r a g e   v e r s i o n .   I t   i s   p o s s i b l e   f o r   a n   o b j e c t   t o   h a v e   b e e n   w r i t t e n   a t   a   v e r s i o n   t h a t   i s   n o   l o n g e r   s e r v e d .   W h e n   y o u   r e a d   a n   o b j e c t ,   y o u   s p e c i f y   t h e   v e r s i o n   a s   p a r t   o f   t h e   p a t h .   Y o u   c a n   r e q u e s t   a n   o b j e c t   a t   a n y   v e r s i o n   t h a t   i s   c u r r e n t l y   s e r v e d .   I f   y o u   s p e c i f y   a   v e r s i o n   t h a t   i s   d i f f e r e n t   f r o m   t h e   o b j e c t ' s   s t o r e d   v e r s i o n ,   K u b e r n e t e s   r e t u r n s   t h e   o b j e c t   t o   y o u   a t   t h e   v e r s i o n   y o u   r e q u e s t e d ,   b u t   t h e   s t o r e d   o b j e c t   i s   n o t   c h a n g e d   o n   d i s k .   W h a t   h a p p e n s   t o   t h e   o b j e c t   t h a t   i s   b e i n g   r e t u r n e d   w h i l e   s e r v i n g   t h e   r e a d   r e q u e s t   d e p e n d s   o n   w h a t   i s   s p e c i f i e d   i n   t h e   C R D ' s   s p e c . c o n v e r s i o n :   i f   t h e   d e f a u l t   s t r a t e g y   v a l u e   N o n e   i s   s p e c i f i e d ,   t h e   o n l y   m o d i f i c a t i o n s   t o   t h e   o b j e c t   a r e   c h a n g i n g   t h e   a p i V e r s i o n   s t r i n g   a n d   p e r h a p s   p r u n i n g   u n k n o w n   f i e l d s   ( d e p e n d


Question: What is Previous storage versions?

Answer: T h e   A P I   s e r v e r   r e c o r d s   e a c h   v e r s i o n   w h i c h   h a s   e v e r   b e e n   m a r k e d   a s   t h e   s t o r a g e   v e r s i o n   i n   t h e   s t a t u s   f i e l d   s t o r e d V e r s i o n s .   O b j e c t s   m a y   h a v e   b e e n   s t o r e d   a t   a n y   v e r s i o n   t h a t   h a s   e v e r   b e e n   d e s i g n a t e d   a s   a   s t o r a g e   v e r s i o n .   N o   o b j e c t s   c a n   e x i s t   i n   s t o r a g e   a t   a   v e r s i o n   t h a t   h a s   n e v e r   b e e n   a   s t o r a g e   v e r s i o n .


Question: What is Upgrade existing objects to a new stored version?

Answer: W h e n   d e p r e c a t i n g   v e r s i o n s   a n d   d r o p p i n g   s u p p o r t ,   s e l e c t   a   s t o r a g e   u p g r a d e   p r o c e d u r e .   O p t i o n   1 :   U s e   t h e   S t o r a g e   V e r s i o n   M i g r a t o r   R u n   t h e   s t o r a g e   V e r s i o n   m i g r a t o r R e m o v e   t h e   o l d   v e r s i o n   f r o m   t h e   C u s t o m R e s o u r c e D e f i n i t i o n   s t a t u s . s t o r e d V e r s i o n s   f i e l d .   O p t i o n   2 :   M a n u a l l y   u p g r a d e   t h e   e x i s t i n g   o b j e c t s   t o   a   n e w   s t o r e d   v e r s i o n   T h e   f o l l o w i n g   i s   a n   e x a m p l e   p r o c e d u r e   t o   u p g r a d e   f r o m   v 1 b e t a 1   t o   v 1 .   S e t   v 1   a s   t h e   s t o r a g e   i n   t h e   C u s t o m R e s o u r c e D e f i n i t i o n   f i l e   a n d   a p p l y   i t   u s i n g   k u b e c t l .   T h e   s t o r e d V e r s i o n s   i s   n o w   v 1 b e t a 1 ,   v 1 . W r i t e   a n   u p g r a d e   p r o c e d u r e   t o   l i s t   a l l   e x i s t i n g   o b j e c t s   a n d   w r i t e   t h e m   w i t h   t h e   s a m e   c o n t e n t .   T h i s   f o r c e s   t h e   b a c k e n d   t o   w r i t e   o b j e c t s   i n   t h e   c u r r e n t   s t o r a g e   v e r s i o n ,   w h i c h   i s   v 1 . R e m o v e   v 1 b e t a 1   f r o m   t h e   C u s t o m R e s o u r c e D e f i n i t i o n   s t a t u s . s t o r e d V e r s i o n s   f i e l d .


Question: What is Note:?

Answer: H e r e   i s   a n   e x a m p l e   o f   h o w   t o   p a t c h   t h e   s t a t u s   s u b r e s o u r c e   f o r   a   C R D   o b j e c t   u s i n g   k u b e c t l :   k u b e c t l   p a t c h   c u s t o m r e s o u r c e d e f i n i t i o n s   < C R D _ N a m e >   - - s u b r e s o u r c e = ' s t a t u s '   - - t y p e = ' m e r g e '   - p   ' { " s t a t u s " : { " s t o r e d V e r s i o n s " : [ " v 1 " ] } } '


Question: What is Concepts?

Answer: The Concepts section helps you learn about the parts of the Kubernetes system and the abstractions Kubernetes uses to represent your cluster, and helps you obtain a deeper understanding of how Kubernetes works.OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.Cluster ArchitectureThe architectural concepts behind Kubernetes.ContainersTechnology for packaging an application along with its runtime dependencies.WorkloadsUnderstand Pods, the smallest deployable compute object in Kubernetes, and the higher-level abstractions that help you to run them.Services, Load Balancing, and NetworkingConcepts and resources behind networking in Kubernetes.StorageWays to provide both long-term and temporary storage to Pods in your cluster.ConfigurationResources that Kubernetes provides for configuring Pods.SecurityConcepts for keeping your cloud-native workload secure.PoliciesManage security and best-practices with policies.Scheduling, Preemption and EvictionCluster AdministrationLower-level detail relevant to creating or administering a Kubernetes cluster.Windows in KubernetesKubernetes supports nodes that run Microsoft Windows.Extending KubernetesDifferent ways to change the behavior of your Kubernetes cluster.


Question: How does Concepts work?

Answer: The Concepts section helps you learn about the parts of the Kubernetes system and the abstractions Kubernetes uses to represent your cluster, and helps you obtain a deeper understanding of how Kubernetes works.OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.Cluster ArchitectureThe architectural concepts behind Kubernetes.ContainersTechnology for packaging an application along with its runtime dependencies.WorkloadsUnderstand Pods, the smallest deployable compute object in Kubernetes, and the higher-level abstractions that help you to run them.Services, Load Balancing, and NetworkingConcepts and resources behind networking in Kubernetes.StorageWays to provide both long-term and temporary storage to Pods in your cluster.ConfigurationResources that Kubernetes provides for configuring Pods.SecurityConcepts for keeping your cloud-native workload secure.PoliciesManage security and best-practices with policies.Scheduling, Preemption and EvictionCluster AdministrationLower-level detail relevant to creating or administering a Kubernetes cluster.Windows in KubernetesKubernetes supports nodes that run Microsoft Windows.Extending KubernetesDifferent ways to change the behavior of your Kubernetes cluster.


Question: When would you use Concepts?

Answer: The Concepts section helps you learn about the parts of the Kubernetes system and the abstractions Kubernetes uses to represent your cluster, and helps you obtain a deeper understanding of how Kubernetes works.OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.Cluster ArchitectureThe architectural concepts behind Kubernetes.ContainersTechnology for packaging an application along with its runtime dependencies.WorkloadsUnderstand Pods, the smallest deployable compute object in Kubernetes, and the higher-level abstractions that help you to run them.Services, Load Balancing, and NetworkingConcepts and resources behind networking in Kubernetes.StorageWays to provide both long-term and temporary storage to Pods in your cluster.ConfigurationResources that Kubernetes provides for configuring Pods.SecurityConcepts for keeping your cloud-native workload secure.PoliciesManage security and best-practices with policies.Scheduling, Preemption and EvictionCluster AdministrationLower-level detail relevant to creating or administering a Kubernetes cluster.Windows in KubernetesKubernetes supports nodes that run Microsoft Windows.Extending KubernetesDifferent ways to change the behavior of your Kubernetes cluster.


Question: What are the benefits of Concepts?

Answer: The Concepts section helps you learn about the parts of the Kubernetes system and the abstractions Kubernetes uses to represent your cluster, and helps you obtain a deeper understanding of how Kubernetes works.OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.Cluster ArchitectureThe architectural concepts behind Kubernetes.ContainersTechnology for packaging an application along with its runtime dependencies.WorkloadsUnderstand Pods, the smallest deployable compute object in Kubernetes, and the higher-level abstractions that help you to run them.Services, Load Balancing, and NetworkingConcepts and resources behind networking in Kubernetes.StorageWays to provide both long-term and temporary storage to Pods in your cluster.ConfigurationResources that Kubernetes provides for configuring Pods.SecurityConcepts for keeping your cloud-native workload secure.PoliciesManage security and best-practices with policies.Scheduling, Preemption and EvictionCluster AdministrationLower-level detail relevant to creating or administering a Kubernetes cluster.Windows in KubernetesKubernetes supports nodes that run Microsoft Windows.Extending KubernetesDifferent ways to change the behavior of your Kubernetes cluster.


Question: What is Concepts?

Answer: K u b e r n e t e s   D o c u m e n t a t i o n   D o c u m e n t a t i o n   A v a i l a b l e   D o c u m e n t a t i o n   V e r s i o n s   G e t t i n g   s t a r t e d   L e a r n i n g   e n v i r o n m e n t   P r o d u c t i o n   e n v i r o n m e n t   C o n t a i n e r   R u n t i m e s   I n s t a l l i n g   K u b e r n e t e s   w i t h   d e p l o y m e n t   t o o l s   B o o t s t r a p p i n g   c l u s t e r s   w i t h   k u b e a d m   I n s t a l l i n g   k u b e a d m   T r o u b l e s h o o t i n g   k u b e a d m   C r e a t i n g   a   c l u s t e r   w i t h   k u b e a d m   C u s t o m i z i n g   c o m p o n e n t s   w i t h   t h e   k u b e a d m   A P I   O p t i o n s   f o r   H i g h l y   A v a i l a b l e   T o p o l o g y   C r e a t i n g   H i g h l y   A v a i l a b l e   C l u s t e r s   w i t h   k u b e a d m   S e t   u p   a   H i g h   A v a i l a b i l i t y   e t c d   C l u s t e r   w i t h   k u b e a d m   C o n f i g u r i n g   e a c h   k u b e l e t   i n   y o u r   c l u s t e r   u s i n g   k u b e a d m   D u a l - s t a c k   s u p p o r t   w i t h   k u b e a d m   T u r n k e y   C l o u d   S o l u t i o n s   B e s t   p r a c t i c e s   C o n s i d e r a t i o n s   f o r   l a r g e   c l u s t e r s   R u n n i n g   i n   m u l t i p l e   z o n e s   V a l i d a t e   n o d e   s e t u p   E n f o r c i n g   P o d   S e c u r i t y   S t a n d a r d s   P K I   c e r t i f i c a t e s   a n d   r e q u i r e m e n t s   C o n c e p t s   O v e r v i e w   K u b e r n e t e s   C o m p o n e n t s   O b j e c t s   I n   K u b e r n e t e s   K u b e r n e t e s   O b j e c t   M a n a g e m e n t   O b j e c t   N a m e s   a n d   I D s   L a b e l s   a n d   S e l e c t o r s   N a m e s p a c e s   A n n o t a t i o n s   F i e l d   S e l e c t o r s   F i n a l i z e r s   O w n e r s   a n d   D e p e n d e n t s   R e c o m m e n d e d   L a b e l s   T h e   K u b e r n e t e s


Question: What is Overview?

Answer: K u b e r n e t e s   i s   a   p o r t a b l e ,   e x t e n s i b l e ,   o p e n   s o u r c e   p l a t f o r m   f o r   m a n a g i n g   c o n t a i n e r i z e d   w o r k l o a d s   a n d   s e r v i c e s ,   t h a t   f a c i l i t a t e s   b o t h   d e c l a r a t i v e   c o n f i g u r a t i o n   a n d   a u t o m a t i o n .   I t   h a s   a   l a r g e ,   r a p i d l y   g r o w i n g   e c o s y s t e m .   K u b e r n e t e s   s e r v i c e s ,   s u p p o r t ,   a n d   t o o l s   a r e   w i d e l y   a v a i l a b l e .


Question: What is Cluster Architecture?

Answer: T h e   a r c h i t e c t u r a l   c o n c e p t s   b e h i n d   K u b e r n e t e s .


Question: What is Containers?

Answer: T e c h n o l o g y   f o r   p a c k a g i n g   a n   a p p l i c a t i o n   a l o n g   w i t h   i t s   r u n t i m e   d e p e n d e n c i e s .


Question: What is Workloads?

Answer: U n d e r s t a n d   P o d s ,   t h e   s m a l l e s t   d e p l o y a b l e   c o m p u t e   o b j e c t   i n   K u b e r n e t e s ,   a n d   t h e   h i g h e r - l e v e l   a b s t r a c t i o n s   t h a t   h e l p   y o u   t o   r u n   t h e m .


Question: What is Services, Load Balancing, and Networking?

Answer: C o n c e p t s   a n d   r e s o u r c e s   b e h i n d   n e t w o r k i n g   i n   K u b e r n e t e s .


Question: What is Storage?

Answer: W a y s   t o   p r o v i d e   b o t h   l o n g - t e r m   a n d   t e m p o r a r y   s t o r a g e   t o   P o d s   i n   y o u r   c l u s t e r .


Question: What is Configuration?

Answer: R e s o u r c e s   t h a t   K u b e r n e t e s   p r o v i d e s   f o r   c o n f i g u r i n g   P o d s .


Question: What is Security?

Answer: C o n c e p t s   f o r   k e e p i n g   y o u r   c l o u d - n a t i v e   w o r k l o a d   s e c u r e .


Question: What is Policies?

Answer: M a n a g e   s e c u r i t y   a n d   b e s t - p r a c t i c e s   w i t h   p o l i c i e s .


Question: What is Cluster Administration?

Answer: L o w e r - l e v e l   d e t a i l   r e l e v a n t   t o   c r e a t i n g   o r   a d m i n i s t e r i n g   a   K u b e r n e t e s   c l u s t e r .


Question: What is Windows in Kubernetes?

Answer: K u b e r n e t e s   s u p p o r t s   n o d e s   t h a t   r u n   M i c r o s o f t   W i n d o w s .


Question: What is Extending Kubernetes?

Answer: D i f f e r e n t   w a y s   t o   c h a n g e   t h e   b e h a v i o r   o f   y o u r   K u b e r n e t e s   c l u s t e r .


Question: What is Policies?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.PoliciesManage security and best-practices with policies.1: Limit Ranges2: Resource Quotas3: Process ID Limits And Reservations4: Node Resource ManagersKubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in


Question: How does Policies work?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.PoliciesManage security and best-practices with policies.1: Limit Ranges2: Resource Quotas3: Process ID Limits And Reservations4: Node Resource ManagersKubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in


Question: When would you use Policies?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.PoliciesManage security and best-practices with policies.1: Limit Ranges2: Resource Quotas3: Process ID Limits And Reservations4: Node Resource ManagersKubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in


Question: What are the benefits of Policies?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.PoliciesManage security and best-practices with policies.1: Limit Ranges2: Resource Quotas3: Process ID Limits And Reservations4: Node Resource ManagersKubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in


Question: What is Policies?

Answer: 1 :   L i m i t   R a n g e s 2 :   R e s o u r c e   Q u o t a s 3 :   P r o c e s s   I D   L i m i t s   A n d   R e s e r v a t i o n s 4 :   N o d e   R e s o u r c e   M a n a g e r s   K u b e r n e t e s   p o l i c i e s   a r e   c o n f i g u r a t i o n s   t h a t   m a n a g e   o t h e r   c o n f i g u r a t i o n s   o r   r u n t i m e   b e h a v i o r s .   K u b e r n e t e s   o f f e r s   v a r i o u s   f o r m s   o f   p o l i c i e s ,   d e s c r i b e d   b e l o w :


Question: What is Apply policies using API objects?

Answer: S o m e   A P I   o b j e c t s   a c t   a s   p o l i c i e s .   H e r e   a r e   s o m e   e x a m p l e s :   N e t w o r k P o l i c i e s   c a n   b e   u s e d   t o   r e s t r i c t   i n g r e s s   a n d   e g r e s s   t r a f f i c   f o r   a   w o r k l o a d . L i m i t R a n g e s   m a n a g e   r e s o u r c e   a l l o c a t i o n   c o n s t r a i n t s   a c r o s s   d i f f e r e n t   o b j e c t   k i n d s . R e s o u r c e Q u o t a s   l i m i t   r e s o u r c e   c o n s u m p t i o n   f o r   a   n a m e s p a c e .


Question: What is Apply policies using admission controllers?

Answer: A n   a d m i s s i o n   c o n t r o l l e r   r u n s   i n   t h e   A P I   s e r v e r   a n d   c a n   v a l i d a t e   o r   m u t a t e   A P I   r e q u e s t s .   S o m e   a d m i s s i o n   c o n t r o l l e r s   a c t   t o   a p p l y   p o l i c i e s .   F o r   e x a m p l e ,   t h e   A l w a y s P u l l I m a g e s   a d m i s s i o n   c o n t r o l l e r   m o d i f i e s   a   n e w   P o d   t o   s e t   t h e   i m a g e   p u l l   p o l i c y   t o   A l w a y s .   K u b e r n e t e s   h a s   s e v e r a l   b u i l t - i n   a d m i s s i o n   c o n t r o l l e r s   t h a t   a r e   c o n f i g u r a b l e   v i a   t h e   A P I   s e r v e r   - - e n a b l e - a d m i s s i o n - p l u g i n s   f l a g .   D e t a i l s   o n   a d m i s s i o n   c o n t r o l l e r s ,   w i t h   t h e   c o m p l e t e   l i s t   o f   a v a i l a b l e   a d m i s s i o n   c o n t r o l l e r s ,   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   A d m i s s i o n   C o n t r o l l e r s


Question: What is Apply policies using ValidatingAdmissionPolicy?

Answer: V a l i d a t i n g   a d m i s s i o n   p o l i c i e s   a l l o w   c o n f i g u r a b l e   v a l i d a t i o n   c h e c k s   t o   b e   e x e c u t e d   i n   t h e   A P I   s e r v e r   u s i n g   t h e   C o m m o n   E x p r e s s i o n   L a n g u a g e   ( C E L ) .   F o r   e x a m p l e ,   a   V a l i d a t i n g A d m i s s i o n P o l i c y   c a n   b e   u s e d   t o   d i s a l l o w   u s e   o f   t h e   l a t e s t   i m a g e   t a g .   A   V a l i d a t i n g A d m i s s i o n P o l i c y   o p e r a t e s   o n   a n   A P I   r e q u e s t   a n d   c a n   b e   u s e d   t o   b l o c k ,   a u d i t ,   a n d   w a r n   u s e r s   a b o u t   n o n - c o m p l i a n t   c o n f i g u r a t i o n s .   D e t a i l s   o n   t h e   V a l i d a t i n g A d m i s s i o n P o l i c y   A P I ,   w i t h   e x a m p l e s ,   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   V a l i d a t i n g   A d m i s s i o n   P o l i c y


Question: What is Apply policies using dynamic admission control?

Answer: D y n a m i c   a d m i s s i o n   c o n t r o l l e r s   ( o r   a d m i s s i o n   w e b h o o k s )   r u n   o u t s i d e   t h e   A P I   s e r v e r   a s   s e p a r a t e   a p p l i c a t i o n s   t h a t   r e g i s t e r   t o   r e c e i v e   w e b h o o k s   r e q u e s t s   t o   p e r f o r m   v a l i d a t i o n   o r   m u t a t i o n   o f   A P I   r e q u e s t s .   D y n a m i c   a d m i s s i o n   c o n t r o l l e r s   c a n   b e   u s e d   t o   a p p l y   p o l i c i e s   o n   A P I   r e q u e s t s   a n d   t r i g g e r   o t h e r   p o l i c y - b a s e d   w o r k f l o w s .   A   d y n a m i c   a d m i s s i o n   c o n t r o l l e r   c a n   p e r f o r m   c o m p l e x   c h e c k s   i n c l u d i n g   t h o s e   t h a t   r e q u i r e   r e t r i e v a l   o f   o t h e r   c l u s t e r   r e s o u r c e s   a n d   e x t e r n a l   d a t a .   F o r   e x a m p l e ,   a n   i m a g e   v e r i f i c a t i o n   c h e c k   c a n   l o o k u p   d a t a   f r o m   O C I   r e g i s t r i e s   t o   v a l i d a t e   t h e   c o n t a i n e r   i m a g e   s i g n a t u r e s   a n d   a t t e s t a t i o n s .   D e t a i l s   o n   d y n a m i c   a d m i s s i o n   c o n t r o l   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   D y n a m i c   A d m i s s i o n   C o n t r o l


Question: What is Implementations?

Answer: D y n a m i c   A d m i s s i o n   C o n t r o l l e r s   t h a t   a c t   a s   f l e x i b l e   p o l i c y   e n g i n e s   a r e   b e i n g   d e v e l o p e d   i n   t h e   K u b e r n e t e s   e c o s y s t e m ,   s u c h   a s :   K u b e w a r d e n K y v e r n o O P A   G a t e k e e p e r P o l a r i s