Question: When would you use Debugging Kubernetes nodes with crictl?

Answer: Debugging Kubernetes nodes with crictlFEATURE STATE: Kubernetes v1.11 [stable]crictl is a command-line interface for CRI-compatible container runtimes. You can use it to inspect and debug container runtimes and applications on a Kubernetes node. crictl and its source are hosted in the cri-tools repository.Before you begincrictl requires a Linux operating system with a CRI runtime.Installing crictlYou can download a compressed archive crictl from the cri-tools release page, for several different architectures. Download the version that corresponds to your version of Kubernetes. Extract it and move it to a location on your system path, such as /usr/local/bin/.General usageThe crictl command has several subcommands and runtime flags. Use crictl help or crictl <subcommand> help for more details.You can set the endpoint for crictl by doing one of the following:Set the --runtime-endpoint and --image-endpoint flags.Set the CONTAINER_RUNTIME_ENDPOINT and IMAGE_SERVICE_ENDPOINT environment variables.Set the endpoint in the configuration file /etc/crictl.yaml. To specify a different file, use the --config=PATH_TO_FILE flag when you run crictl.Note:If you don't set an endpoint, crictl attempts to connect to a list of known endpoints, which might result in an impact to performance.You can also specify timeout values when connecting to the server and enable or disable debugging, by specifying timeout or debug values in the configuration file or using the --timeout and --debug command-line flags.To view or edit the current configuration, view or edit the contents of /etc/crictl.yaml. For example, the configuration when using the containerd container runtime would be similar to this:runtime-endpoint: unix:///var/run/containerd/containerd.sock image-endpoint: unix:///var/run/containerd/containerd.sock timeout: 10 debug: true To learn more about crictl, refer to the crictl documentation.Example crictl commandsThe following examples show some crictl commands and example output.List podsList all pods:crictl pods The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 926f1b5a1d33a About a minute ago Ready sh-84d7dcf559-4r2gq default 0 4dccb216c4adb About a minute ago Ready nginx-65899c769f-wv2gp default 0 a86316e96fa89 17 hours ago Ready kube-proxy-gblk4 kube-system 0 919630b8f81f1 17 hours ago Ready nvidia-device-plugin-zgbbv kube-system 0 List pods by name:crictl pods --name nginx-65899c769f-wv2gp The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 4dccb216c4adb 2 minutes ago Ready nginx-65899c769f-wv2gp default 0 List pods by label:crictl pods --label run=nginx The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 4dccb216c4adb 2 minutes ago Ready nginx-65899c769f-wv2gp default 0 List imagesList all images:crictl images The output is similar to this:IMAGE TAG IMAGE ID SIZE busybox latest 8c811b4aec35f 1.15MB k8s-gcrio.azureedge.net/hyperkube-amd64 v1.10.3 e179bbfe5d238 665MB k8s-gcrio.azureedge.net/paus


Question: What are the benefits of Debugging Kubernetes nodes with crictl?

Answer: Debugging Kubernetes nodes with crictlFEATURE STATE: Kubernetes v1.11 [stable]crictl is a command-line interface for CRI-compatible container runtimes. You can use it to inspect and debug container runtimes and applications on a Kubernetes node. crictl and its source are hosted in the cri-tools repository.Before you begincrictl requires a Linux operating system with a CRI runtime.Installing crictlYou can download a compressed archive crictl from the cri-tools release page, for several different architectures. Download the version that corresponds to your version of Kubernetes. Extract it and move it to a location on your system path, such as /usr/local/bin/.General usageThe crictl command has several subcommands and runtime flags. Use crictl help or crictl <subcommand> help for more details.You can set the endpoint for crictl by doing one of the following:Set the --runtime-endpoint and --image-endpoint flags.Set the CONTAINER_RUNTIME_ENDPOINT and IMAGE_SERVICE_ENDPOINT environment variables.Set the endpoint in the configuration file /etc/crictl.yaml. To specify a different file, use the --config=PATH_TO_FILE flag when you run crictl.Note:If you don't set an endpoint, crictl attempts to connect to a list of known endpoints, which might result in an impact to performance.You can also specify timeout values when connecting to the server and enable or disable debugging, by specifying timeout or debug values in the configuration file or using the --timeout and --debug command-line flags.To view or edit the current configuration, view or edit the contents of /etc/crictl.yaml. For example, the configuration when using the containerd container runtime would be similar to this:runtime-endpoint: unix:///var/run/containerd/containerd.sock image-endpoint: unix:///var/run/containerd/containerd.sock timeout: 10 debug: true To learn more about crictl, refer to the crictl documentation.Example crictl commandsThe following examples show some crictl commands and example output.List podsList all pods:crictl pods The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 926f1b5a1d33a About a minute ago Ready sh-84d7dcf559-4r2gq default 0 4dccb216c4adb About a minute ago Ready nginx-65899c769f-wv2gp default 0 a86316e96fa89 17 hours ago Ready kube-proxy-gblk4 kube-system 0 919630b8f81f1 17 hours ago Ready nvidia-device-plugin-zgbbv kube-system 0 List pods by name:crictl pods --name nginx-65899c769f-wv2gp The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 4dccb216c4adb 2 minutes ago Ready nginx-65899c769f-wv2gp default 0 List pods by label:crictl pods --label run=nginx The output is similar to this:POD ID CREATED STATE NAME NAMESPACE ATTEMPT 4dccb216c4adb 2 minutes ago Ready nginx-65899c769f-wv2gp default 0 List imagesList all images:crictl images The output is similar to this:IMAGE TAG IMAGE ID SIZE busybox latest 8c811b4aec35f 1.15MB k8s-gcrio.azureedge.net/hyperkube-amd64 v1.10.3 e179bbfe5d238 665MB k8s-gcrio.azureedge.net/paus


Question: What is Debugging Kubernetes nodes with crictl?

Answer: c r i c t l   i s   a   c o m m a n d - l i n e   i n t e r f a c e   f o r   C R I - c o m p a t i b l e   c o n t a i n e r   r u n t i m e s .   Y o u   c a n   u s e   i t   t o   i n s p e c t   a n d   d e b u g   c o n t a i n e r   r u n t i m e s   a n d   a p p l i c a t i o n s   o n   a   K u b e r n e t e s   n o d e .   c r i c t l   a n d   i t s   s o u r c e   a r e   h o s t e d   i n   t h e   c r i - t o o l s   r e p o s i t o r y .


Question: What is Before you begin?

Answer: c r i c t l   r e q u i r e s   a   L i n u x   o p e r a t i n g   s y s t e m   w i t h   a   C R I   r u n t i m e .


Question: What is Installing crictl?

Answer: Y o u   c a n   d o w n l o a d   a   c o m p r e s s e d   a r c h i v e   c r i c t l   f r o m   t h e   c r i - t o o l s   r e l e a s e   p a g e ,   f o r   s e v e r a l   d i f f e r e n t   a r c h i t e c t u r e s .   D o w n l o a d   t h e   v e r s i o n   t h a t   c o r r e s p o n d s   t o   y o u r   v e r s i o n   o f   K u b e r n e t e s .   E x t r a c t   i t   a n d   m o v e   i t   t o   a   l o c a t i o n   o n   y o u r   s y s t e m   p a t h ,   s u c h   a s   / u s r / l o c a l / b i n / .


Question: What is General usage?

Answer: T h e   c r i c t l   c o m m a n d   h a s   s e v e r a l   s u b c o m m a n d s   a n d   r u n t i m e   f l a g s .   U s e   c r i c t l   h e l p   o r   c r i c t l   < s u b c o m m a n d >   h e l p   f o r   m o r e   d e t a i l s .   Y o u   c a n   s e t   t h e   e n d p o i n t   f o r   c r i c t l   b y   d o i n g   o n e   o f   t h e   f o l l o w i n g :   S e t   t h e   - - r u n t i m e - e n d p o i n t   a n d   - - i m a g e - e n d p o i n t   f l a g s . S e t   t h e   C O N T A I N E R _ R U N T I M E _ E N D P O I N T   a n d   I M A G E _ S E R V I C E _ E N D P O I N T   e n v i r o n m e n t   v a r i a b l e s . S e t   t h e   e n d p o i n t   i n   t h e   c o n f i g u r a t i o n   f i l e   / e t c / c r i c t l . y a m l .   T o   s p e c i f y   a   d i f f e r e n t   f i l e ,   u s e   t h e   - - c o n f i g = P A T H _ T O _ F I L E   f l a g   w h e n   y o u   r u n   c r i c t l .


Question: What is Note:?

Answer: Y o u   c a n   a l s o   s p e c i f y   t i m e o u t   v a l u e s   w h e n   c o n n e c t i n g   t o   t h e   s e r v e r   a n d   e n a b l e   o r   d i s a b l e   d e b u g g i n g ,   b y   s p e c i f y i n g   t i m e o u t   o r   d e b u g   v a l u e s   i n   t h e   c o n f i g u r a t i o n   f i l e   o r   u s i n g   t h e   - - t i m e o u t   a n d   - - d e b u g   c o m m a n d - l i n e   f l a g s .   T o   v i e w   o r   e d i t   t h e   c u r r e n t   c o n f i g u r a t i o n ,   v i e w   o r   e d i t   t h e   c o n t e n t s   o f   / e t c / c r i c t l . y a m l .   F o r   e x a m p l e ,   t h e   c o n f i g u r a t i o n   w h e n   u s i n g   t h e   c o n t a i n e r d   c o n t a i n e r   r u n t i m e   w o u l d   b e   s i m i l a r   t o   t h i s :   r u n t i m e - e n d p o i n t :   u n i x : / / / v a r / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k   i m a g e - e n d p o i n t :   u n i x : / / / v a r / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k   t i m e o u t :   1 0   d e b u g :   t r u e   T o   l e a r n   m o r e   a b o u t   c r i c t l ,   r e f e r   t o   t h e   c r i c t l   d o c u m e n t a t i o n .


Question: What is Example crictl commands?

Answer: T h e   f o l l o w i n g   e x a m p l e s   s h o w   s o m e   c r i c t l   c o m m a n d s   a n d   e x a m p l e   o u t p u t .


Question: What is List pods?

Answer: L i s t   a l l   p o d s :   c r i c t l   p o d s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   P O D   I D   C R E A T E D   S T A T E   N A M E   N A M E S P A C E   A T T E M P T   9 2 6 f 1 b 5 a 1 d 3 3 a   A b o u t   a   m i n u t e   a g o   R e a d y   s h - 8 4 d 7 d c f 5 5 9 - 4 r 2 g q   d e f a u l t   0   4 d c c b 2 1 6 c 4 a d b   A b o u t   a   m i n u t e   a g o   R e a d y   n g i n x - 6 5 8 9 9 c 7 6 9 f - w v 2 g p   d e f a u l t   0   a 8 6 3 1 6 e 9 6 f a 8 9   1 7   h o u r s   a g o   R e a d y   k u b e - p r o x y - g b l k 4   k u b e - s y s t e m   0   9 1 9 6 3 0 b 8 f 8 1 f 1   1 7   h o u r s   a g o   R e a d y   n v i d i a - d e v i c e - p l u g i n - z g b b v   k u b e - s y s t e m   0   L i s t   p o d s   b y   n a m e :   c r i c t l   p o d s   - - n a m e   n g i n x - 6 5 8 9 9 c 7 6 9 f - w v 2 g p   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   P O D   I D   C R E A T E D   S T A T E   N A M E   N A M E S P A C E   A T T E M P T   4 d c c b 2 1 6 c 4 a d b   2   m i n u t e s   a g o   R e a d y   n g i n x - 6 5 8 9 9 c 7 6 9 f - w v 2 g p   d e f a u l t   0   L i s t   p o d s   b y   l a b e l :   c r i c t l   p o d s   - - l a b e l   r u n = n g i n x   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   P O D   I D   C R E A T E D   S T A T E   N A M E   N A M E S P A C E   A T T E M P T   4 d c c b 2 1 6 c 4 a d b   2   m i n u t e s   a g o   R e a d y   n g i n x - 6 5 8 9 9 c 7 6 9 f - w v 2 g p   d e f a u l t   0


Question: What is List images?

Answer: L i s t   a l l   i m a g e s :   c r i c t l   i m a g e s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   I M A G E   T A G   I M A G E   I D   S I Z E   b u s y b o x   l a t e s t   8 c 8 1 1 b 4 a e c 3 5 f   1 . 1 5 M B   k 8 s - g c r i o . a z u r e e d g e . n e t / h y p e r k u b e - a m d 6 4   v 1 . 1 0 . 3   e 1 7 9 b b f e 5 d 2 3 8   6 6 5 M B   k 8 s - g c r i o . a z u r e e d g e . n e t / p a u s e - a m d 6 4   3 . 1   d a 8 6 e 6 b a 6 c a 1 9   7 4 2 k B   n g i n x   l a t e s t   c d 5 2 3 9 a 0 9 0 6 a 6   1 0 9 M B   L i s t   i m a g e s   b y   r e p o s i t o r y :   c r i c t l   i m a g e s   n g i n x   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   I M A G E   T A G   I M A G E   I D   S I Z E   n g i n x   l a t e s t   c d 5 2 3 9 a 0 9 0 6 a 6   1 0 9 M B   O n l y   l i s t   i m a g e   I D s :   c r i c t l   i m a g e s   - q   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   s h a 2 5 6 : 8 c 8 1 1 b 4 a e c 3 5 f 2 5 9 5 7 2 d 0 f 7 9 2 0 7 b c 0 6 7 8 d f 4 c 7 3 6 e e e c 5 0 b c 9 f e c 3 7 e d 9 3 6 a 4 7 2 a   s h a 2 5 6 : e 1 7 9 b b f e 5 d 2 3 8 d e 6 0 6 9 f 3 b 0 3 f c c b e c c 3 f b 4 f 2 0 1 9 a f 7 4 1 b f f f 1 2 3 3 c 4 d 7 b 2 9 7 0 c 5   s h a 2 5 6 : d a 8 6 e 6 b a 6 c a 1 9 7 b f 6 b c 5 e 9 d 9 0 0 f e b d 9 0 6 b 1 3 3 e a a 4 7 5 0 e 6 b e d 6 4 7 b 0 f b e 5 0 e d 4 3 e   s h a 2 5 6 : c d 5 2 3 9 a 0 9 0 6 a 6 c c f 0 5 6 2 3 5 4 8 5 2 f a e 0 4 b c 5 b 5 2 d 7 2 a 2 a f f 9 a 8 7 1 d d b 6 b d 5 7 5 5 3 5 6 9


Question: What is List containers?

Answer: L i s t   a l l   c o n t a i n e r s :   c r i c t l   p s   - a   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   C O N T A I N E R   I D   I M A G E   C R E A T E D   S T A T E   N A M E   A T T E M P T   1 f 7 3 f 2 d 8 1 b f 9 8   b u s y b o x @ s h a 2 5 6 : 1 4 1 c 2 5 3 b c 4 c 3 f d 0 a 2 0 1 d 3 2 d c 1 f 4 9 3 b c f 3 f f f 0 0 3 b 6 d f 4 1 6 d e a 4 f 4 1 0 4 6 e 0 f 3 7 d 4 7   7   m i n u t e s   a g o   R u n n i n g   s h   1   9 c 5 9 5 1 d f 2 2 c 7 8   b u s y b o x @ s h a 2 5 6 : 1 4 1 c 2 5 3 b c 4 c 3 f d 0 a 2 0 1 d 3 2 d c 1 f 4 9 3 b c f 3 f f f 0 0 3 b 6 d f 4 1 6 d e a 4 f 4 1 0 4 6 e 0 f 3 7 d 4 7   8   m i n u t e s   a g o   E x i t e d   s h   0   8 7 d 3 9 9 2 f 8 4 f 7 4   n g i n x @ s h a 2 5 6 : d 0 a 8 8 2 8 c c c b 7 3 3 9 7 a c b 0 0 7 3 b f 3 4 f 4 d 7 d 8 a a 3 1 5 2 6 3 f 1 e 7 8 0 6 b f 8 c 5 5 d 8 a c 1 3 9 d 5 f   8   m i n u t e s   a g o   R u n n i n g   n g i n x   0   1 9 4 1 f b 4 d a 1 5 4 f   k 8 s - g c r i o . a z u r e e d g e . n e t / h y p e r k u b e - a m d 6 4 @ s h a 2 5 6 : 0 0 d 8 1 4 b 1 f 7 7 6 3 f 4 a b 5 b e 8 0 c 5 8 e 9 8 1 4 0 d f c 6 9 d f 1 0 7 f 2 5 3 d 7 f d d 7 1 4 b 3 0 a 7 1 4 2 6 0 a   1 8   h o u r s   a g o   R u n n i n g   k u b e - p r o x y   0   L i s t   r u n n i n g   c o n t a i n e r s :   c r i c t l   p s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   C O N T A I N E R   I D   I M A G E   C R E A T E D   S T A T E   N A M E   A T T E M P T   1 f 7 3 f 2 d 8 1 b f 9 8   b u s y b o x @ s h a 2 5 6 : 1 4 1 c 2 5 3 b c 4 c 3 f d 0 a 2 0 1 d 3 2 d c 1 f 4 9 3 b c f 3 f f f 0 0 3 b 6 d f 4 1 6 d e a 4 f 4 1 0 4 6 e 0 f 3 7 d 4 7   6   m i n u t e s   a g o   R u n n i n g   s h   1   8 7 d 3 9 9 2 f 8 4 f 7 4   n g i n x @ s h a 2 5 6 : d 0 a 8 8 2 8 c c c b 7 3 3 9 7 a c b 0 0 7 3 b f 3 4 f 4 d 7 d 8 a a 3 1 5 2 6 3 f 1 e 7 8 0 6 b f 8 c 5 5 d 8 a c 1 3 9 d 5 f   7   m i n u t e s   a g o   R u n n i n g   n g i n x   0   1 9 4 1 f b 4 d a 1 5


Question: What is Execute a command in a running container?

Answer: c r i c t l   e x e c   - i   - t   1 f 7 3 f 2 d 8 1 b f 9 8   l s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   b i n   d e v   e t c   h o m e   p r o c   r o o t   s y s   t m p   u s r   v a r


Question: What is Get a container's logs?

Answer: G e t   a l l   c o n t a i n e r   l o g s :   c r i c t l   l o g s   8 7 d 3 9 9 2 f 8 4 f 7 4   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   1 0 . 2 4 0 . 0 . 9 6   -   -   [ 0 6 / J u n / 2 0 1 8 : 0 2 : 4 5 : 4 9   + 0 0 0 0 ]   " G E T   /   H T T P / 1 . 1 "   2 0 0   6 1 2   " - "   " c u r l / 7 . 4 7 . 0 "   " - "   1 0 . 2 4 0 . 0 . 9 6   -   -   [ 0 6 / J u n / 2 0 1 8 : 0 2 : 4 5 : 5 0   + 0 0 0 0 ]   " G E T   /   H T T P / 1 . 1 "   2 0 0   6 1 2   " - "   " c u r l / 7 . 4 7 . 0 "   " - "   1 0 . 2 4 0 . 0 . 9 6   -   -   [ 0 6 / J u n / 2 0 1 8 : 0 2 : 4 5 : 5 1   + 0 0 0 0 ]   " G E T   /   H T T P / 1 . 1 "   2 0 0   6 1 2   " - "   " c u r l / 7 . 4 7 . 0 "   " - "   G e t   o n l y   t h e   l a t e s t   N   l i n e s   o f   l o g s :   c r i c t l   l o g s   - - t a i l = 1   8 7 d 3 9 9 2 f 8 4 f 7 4   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   1 0 . 2 4 0 . 0 . 9 6   -   -   [ 0 6 / J u n / 2 0 1 8 : 0 2 : 4 5 : 5 1   + 0 0 0 0 ]   " G E T   /   H T T P / 1 . 1 "   2 0 0   6 1 2   " - "   " c u r l / 7 . 4 7 . 0 "   " - "


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   c r i c t l .


Question: What is ClusterRole?

Answer: ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata (ObjectMeta)Standard object's metadata.aggregationRule (AggregationRule)AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRoleaggregationRule.clusterRoleSelectors ([]LabelSelector)Atomic: will be replaced during a mergeClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be addedrules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this ClusterRolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.ClusterRoleListClusterRoleList is a collection of ClusterRolesapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRole), requiredItems is a list of ClusterRolesOperationsget read the specified ClusterRoleHTTP RequestGET /apis/rbac.authorization.k8s.io


Question: How does ClusterRole work?

Answer: ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata (ObjectMeta)Standard object's metadata.aggregationRule (AggregationRule)AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRoleaggregationRule.clusterRoleSelectors ([]LabelSelector)Atomic: will be replaced during a mergeClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be addedrules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this ClusterRolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.ClusterRoleListClusterRoleList is a collection of ClusterRolesapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRole), requiredItems is a list of ClusterRolesOperationsget read the specified ClusterRoleHTTP RequestGET /apis/rbac.authorization.k8s.io


Question: When would you use ClusterRole?

Answer: ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata (ObjectMeta)Standard object's metadata.aggregationRule (AggregationRule)AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRoleaggregationRule.clusterRoleSelectors ([]LabelSelector)Atomic: will be replaced during a mergeClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be addedrules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this ClusterRolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.ClusterRoleListClusterRoleList is a collection of ClusterRolesapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRole), requiredItems is a list of ClusterRolesOperationsget read the specified ClusterRoleHTTP RequestGET /apis/rbac.authorization.k8s.io


Question: What are the benefits of ClusterRole?

Answer: ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata (ObjectMeta)Standard object's metadata.aggregationRule (AggregationRule)AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRoleaggregationRule.clusterRoleSelectors ([]LabelSelector)Atomic: will be replaced during a mergeClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be addedrules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this ClusterRolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.ClusterRoleListClusterRoleList is a collection of ClusterRolesapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRole), requiredItems is a list of ClusterRolesOperationsget read the specified ClusterRoleHTTP RequestGET /apis/rbac.authorization.k8s.io


Question: What is ClusterRole?

Answer: a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / r b a c / v 1 "


Question: What is ClusterRole?

Answer: C l u s t e r R o l e   i s   a   c l u s t e r   l e v e l ,   l o g i c a l   g r o u p i n g   o f   P o l i c y R u l e s   t h a t   c a n   b e   r e f e r e n c e d   a s   a   u n i t   b y   a   R o l e B i n d i n g   o r   C l u s t e r R o l e B i n d i n g .   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   C l u s t e r R o l e m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . a g g r e g a t i o n R u l e   ( A g g r e g a t i o n R u l e ) A g g r e g a t i o n R u l e   i s   a n   o p t i o n a l   f i e l d   t h a t   d e s c r i b e s   h o w   t o   b u i l d   t h e   R u l e s   f o r   t h i s   C l u s t e r R o l e .   I f   A g g r e g a t i o n R u l e   i s   s e t ,   t h e n   t h e   R u l e s   a r e   c o n t r o l l e r   m a n a g e d   a n d   d i r e c t   c h a n g e s   t o   R u l e s   w i l l   b e   s t o m p e d   b y   t h e   c o n t r o l l e r . A g g r e g a t i o n R u l e   d e s c r i b e s   h o w   t o   l o c a t e   C l u s t e r R o l e s   t o   a g g r e g a t e   i n t o   t h e   C l u s t e r R o l e a g g r e g a t i o n R u l e . c l u s t e r R o l e S e l e c t o r s   ( [ ] L a b e l S e l e c t o r ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e C l u s t e r R o l e S e l e c t o r s   h o l d s   a   l i s t   o f   s e l e c t o r s   w h i c h   w i l l   b e   u s e d   t o   f i n d   C l u s t e r R o l e s   a n d   c r e a t e   t h e   r u l e s .   I f   a n y   o f   t h e   s e l e c t o r s   m a t c h ,   t h e n   t h e   C l u s t e r R o l e ' s   p e r m i s s i o n s   w i l l   b e   a d d e d r u l e s   ( [ ] P o l i c y R u l e ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e R u l e s   h o l d s   a l l   t h e   P o l i c y R u l e s   f o r   t h i s   C l u s t e r R o l e P o l i c y R u l e   h o l d s   i n f o r m


Question: What is ClusterRoleList?

Answer: C l u s t e r R o l e L i s t   i s   a   c o l l e c t i o n   o f   C l u s t e r R o l e s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   C l u s t e r R o l e L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . i t e m s   ( [ ] C l u s t e r R o l e ) ,   r e q u i r e d I t e m s   i s   a   l i s t   o f   C l u s t e r R o l e s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   k i n d :   C l u s t e r R o l e L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   i t e m s   ( [ ] C l u s t e r R o l e ) ,   r e q u i r e d   I t e m s   i s   a   l i s t   o f   C l u s t e r R o l e s


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s


Question: What is Parameters?

Answer: b o d y :   C l u s t e r R o l e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   C l u s t e r R o l e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e ) :   O K   2 0 1   ( C l u s t e r R o l e ) :   C r e a t e d   2 0 2   ( C l u s t e r R o l e ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e b o d y :   C l u s t e r R o l e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e   b o d y :   C l u s t e r R o l e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e ) :   O K   2 0 1   ( C l u s t e r R o l e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e ) :   O K   2 0 1   ( C l u s t e r R o l e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   2 0 2   ( S t a t u s ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e s


Question: What is Parameters?

Answer: b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   l a b e l S e l e c t o r   (


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Owners and Dependents?

Answer: Owners and DependentsIn Kubernetes, some objects are owners of other objects. For example, a ReplicaSet is the owner of a set of Pods. These owned objects are dependents of their owner.Ownership is different from the labels and selectors mechanism that some resources also use. For example, consider a Service that creates EndpointSlice objects. The Service uses labels to allow the control plane to determine which EndpointSlice objects are used for that Service. In addition to the labels, each EndpointSlice that is managed on behalf of a Service has an owner reference. Owner references help different parts of Kubernetes avoid interfering with objects they don’t control.Owner references in object specificationsDependent objects have a metadata.ownerReferences field that references their owner object. A valid owner reference consists of the object name and a UID within the same namespace as the dependent object. Kubernetes sets the value of this field automatically for objects that are dependents of other objects like ReplicaSets, DaemonSets, Deployments, Jobs and CronJobs, and ReplicationControllers. You can also configure these relationships manually by changing the value of this field. However, you usually don't need to and can allow Kubernetes to automatically manage the relationships.Dependent objects also have an ownerReferences.blockOwnerDeletion field that takes a boolean value and controls whether specific dependents can block garbage collection from deleting their owner object. Kubernetes automatically sets this field to true if a controller (for example, the Deployment controller) sets the value of the metadata.ownerReferences field. You can also set the value of the blockOwnerDeletion field manually to control which dependents block garbage collection.A Kubernetes admission controller controls user access to change this field for dependent resources, based on the delete permissions of the owner. This control prevents unauthorized users from delaying owner object deletion.Note:Cross-namespace owner references are disallowed by design. Namespaced dependents can specify cluster-scoped or namespaced owners. A namespaced owner must exist in the same namespace as the dependent. If it does not, the owner reference is treated as absent, and the dependent is subject to deletion once all owners are verified absent.Cluster-scoped dependents can only specify cluster-scoped owners. In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, it is treated as having an unresolvable owner reference, and is not able to be garbage collected.In v1.20+, if the garbage collector detects an invalid cross-namespace ownerReference, or a cluster-scoped dependent with an ownerReference referencing a namespaced kind, a warning Event with a reason of OwnerRefInvalidNamespace and an involvedObject of the invalid dependent is reported. You can check for that kind of Event by running kubectl get events -A --field-selector=reason=OwnerRefInvalidNam


Question: How does Owners and Dependents work?

Answer: Owners and DependentsIn Kubernetes, some objects are owners of other objects. For example, a ReplicaSet is the owner of a set of Pods. These owned objects are dependents of their owner.Ownership is different from the labels and selectors mechanism that some resources also use. For example, consider a Service that creates EndpointSlice objects. The Service uses labels to allow the control plane to determine which EndpointSlice objects are used for that Service. In addition to the labels, each EndpointSlice that is managed on behalf of a Service has an owner reference. Owner references help different parts of Kubernetes avoid interfering with objects they don’t control.Owner references in object specificationsDependent objects have a metadata.ownerReferences field that references their owner object. A valid owner reference consists of the object name and a UID within the same namespace as the dependent object. Kubernetes sets the value of this field automatically for objects that are dependents of other objects like ReplicaSets, DaemonSets, Deployments, Jobs and CronJobs, and ReplicationControllers. You can also configure these relationships manually by changing the value of this field. However, you usually don't need to and can allow Kubernetes to automatically manage the relationships.Dependent objects also have an ownerReferences.blockOwnerDeletion field that takes a boolean value and controls whether specific dependents can block garbage collection from deleting their owner object. Kubernetes automatically sets this field to true if a controller (for example, the Deployment controller) sets the value of the metadata.ownerReferences field. You can also set the value of the blockOwnerDeletion field manually to control which dependents block garbage collection.A Kubernetes admission controller controls user access to change this field for dependent resources, based on the delete permissions of the owner. This control prevents unauthorized users from delaying owner object deletion.Note:Cross-namespace owner references are disallowed by design. Namespaced dependents can specify cluster-scoped or namespaced owners. A namespaced owner must exist in the same namespace as the dependent. If it does not, the owner reference is treated as absent, and the dependent is subject to deletion once all owners are verified absent.Cluster-scoped dependents can only specify cluster-scoped owners. In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, it is treated as having an unresolvable owner reference, and is not able to be garbage collected.In v1.20+, if the garbage collector detects an invalid cross-namespace ownerReference, or a cluster-scoped dependent with an ownerReference referencing a namespaced kind, a warning Event with a reason of OwnerRefInvalidNamespace and an involvedObject of the invalid dependent is reported. You can check for that kind of Event by running kubectl get events -A --field-selector=reason=OwnerRefInvalidNam


Question: When would you use Owners and Dependents?

Answer: Owners and DependentsIn Kubernetes, some objects are owners of other objects. For example, a ReplicaSet is the owner of a set of Pods. These owned objects are dependents of their owner.Ownership is different from the labels and selectors mechanism that some resources also use. For example, consider a Service that creates EndpointSlice objects. The Service uses labels to allow the control plane to determine which EndpointSlice objects are used for that Service. In addition to the labels, each EndpointSlice that is managed on behalf of a Service has an owner reference. Owner references help different parts of Kubernetes avoid interfering with objects they don’t control.Owner references in object specificationsDependent objects have a metadata.ownerReferences field that references their owner object. A valid owner reference consists of the object name and a UID within the same namespace as the dependent object. Kubernetes sets the value of this field automatically for objects that are dependents of other objects like ReplicaSets, DaemonSets, Deployments, Jobs and CronJobs, and ReplicationControllers. You can also configure these relationships manually by changing the value of this field. However, you usually don't need to and can allow Kubernetes to automatically manage the relationships.Dependent objects also have an ownerReferences.blockOwnerDeletion field that takes a boolean value and controls whether specific dependents can block garbage collection from deleting their owner object. Kubernetes automatically sets this field to true if a controller (for example, the Deployment controller) sets the value of the metadata.ownerReferences field. You can also set the value of the blockOwnerDeletion field manually to control which dependents block garbage collection.A Kubernetes admission controller controls user access to change this field for dependent resources, based on the delete permissions of the owner. This control prevents unauthorized users from delaying owner object deletion.Note:Cross-namespace owner references are disallowed by design. Namespaced dependents can specify cluster-scoped or namespaced owners. A namespaced owner must exist in the same namespace as the dependent. If it does not, the owner reference is treated as absent, and the dependent is subject to deletion once all owners are verified absent.Cluster-scoped dependents can only specify cluster-scoped owners. In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, it is treated as having an unresolvable owner reference, and is not able to be garbage collected.In v1.20+, if the garbage collector detects an invalid cross-namespace ownerReference, or a cluster-scoped dependent with an ownerReference referencing a namespaced kind, a warning Event with a reason of OwnerRefInvalidNamespace and an involvedObject of the invalid dependent is reported. You can check for that kind of Event by running kubectl get events -A --field-selector=reason=OwnerRefInvalidNam


Question: What are the benefits of Owners and Dependents?

Answer: Owners and DependentsIn Kubernetes, some objects are owners of other objects. For example, a ReplicaSet is the owner of a set of Pods. These owned objects are dependents of their owner.Ownership is different from the labels and selectors mechanism that some resources also use. For example, consider a Service that creates EndpointSlice objects. The Service uses labels to allow the control plane to determine which EndpointSlice objects are used for that Service. In addition to the labels, each EndpointSlice that is managed on behalf of a Service has an owner reference. Owner references help different parts of Kubernetes avoid interfering with objects they don’t control.Owner references in object specificationsDependent objects have a metadata.ownerReferences field that references their owner object. A valid owner reference consists of the object name and a UID within the same namespace as the dependent object. Kubernetes sets the value of this field automatically for objects that are dependents of other objects like ReplicaSets, DaemonSets, Deployments, Jobs and CronJobs, and ReplicationControllers. You can also configure these relationships manually by changing the value of this field. However, you usually don't need to and can allow Kubernetes to automatically manage the relationships.Dependent objects also have an ownerReferences.blockOwnerDeletion field that takes a boolean value and controls whether specific dependents can block garbage collection from deleting their owner object. Kubernetes automatically sets this field to true if a controller (for example, the Deployment controller) sets the value of the metadata.ownerReferences field. You can also set the value of the blockOwnerDeletion field manually to control which dependents block garbage collection.A Kubernetes admission controller controls user access to change this field for dependent resources, based on the delete permissions of the owner. This control prevents unauthorized users from delaying owner object deletion.Note:Cross-namespace owner references are disallowed by design. Namespaced dependents can specify cluster-scoped or namespaced owners. A namespaced owner must exist in the same namespace as the dependent. If it does not, the owner reference is treated as absent, and the dependent is subject to deletion once all owners are verified absent.Cluster-scoped dependents can only specify cluster-scoped owners. In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, it is treated as having an unresolvable owner reference, and is not able to be garbage collected.In v1.20+, if the garbage collector detects an invalid cross-namespace ownerReference, or a cluster-scoped dependent with an ownerReference referencing a namespaced kind, a warning Event with a reason of OwnerRefInvalidNamespace and an involvedObject of the invalid dependent is reported. You can check for that kind of Event by running kubectl get events -A --field-selector=reason=OwnerRefInvalidNam


Question: What is Owners and Dependents?

Answer: I n   K u b e r n e t e s ,   s o m e   o b j e c t s   a r e   o w n e r s   o f   o t h e r   o b j e c t s .   F o r   e x a m p l e ,   a   R e p l i c a S e t   i s   t h e   o w n e r   o f   a   s e t   o f   P o d s .   T h e s e   o w n e d   o b j e c t s   a r e   d e p e n d e n t s   o f   t h e i r   o w n e r .   O w n e r s h i p   i s   d i f f e r e n t   f r o m   t h e   l a b e l s   a n d   s e l e c t o r s   m e c h a n i s m   t h a t   s o m e   r e s o u r c e s   a l s o   u s e .   F o r   e x a m p l e ,   c o n s i d e r   a   S e r v i c e   t h a t   c r e a t e s   E n d p o i n t S l i c e   o b j e c t s .   T h e   S e r v i c e   u s e s   l a b e l s   t o   a l l o w   t h e   c o n t r o l   p l a n e   t o   d e t e r m i n e   w h i c h   E n d p o i n t S l i c e   o b j e c t s   a r e   u s e d   f o r   t h a t   S e r v i c e .   I n   a d d i t i o n   t o   t h e   l a b e l s ,   e a c h   E n d p o i n t S l i c e   t h a t   i s   m a n a g e d   o n   b e h a l f   o f   a   S e r v i c e   h a s   a n   o w n e r   r e f e r e n c e .   O w n e r   r e f e r e n c e s   h e l p   d i f f e r e n t   p a r t s   o f   K u b e r n e t e s   a v o i d   i n t e r f e r i n g   w i t h   o b j e c t s   t h e y   d o n ’ t   c o n t r o l .


Question: What is Owner references in object specifications?

Answer: D e p e n d e n t   o b j e c t s   h a v e   a   m e t a d a t a . o w n e r R e f e r e n c e s   f i e l d   t h a t   r e f e r e n c e s   t h e i r   o w n e r   o b j e c t .   A   v a l i d   o w n e r   r e f e r e n c e   c o n s i s t s   o f   t h e   o b j e c t   n a m e   a n d   a   U I D   w i t h i n   t h e   s a m e   n a m e s p a c e   a s   t h e   d e p e n d e n t   o b j e c t .   K u b e r n e t e s   s e t s   t h e   v a l u e   o f   t h i s   f i e l d   a u t o m a t i c a l l y   f o r   o b j e c t s   t h a t   a r e   d e p e n d e n t s   o f   o t h e r   o b j e c t s   l i k e   R e p l i c a S e t s ,   D a e m o n S e t s ,   D e p l o y m e n t s ,   J o b s   a n d   C r o n J o b s ,   a n d   R e p l i c a t i o n C o n t r o l l e r s .   Y o u   c a n   a l s o   c o n f i g u r e   t h e s e   r e l a t i o n s h i p s   m a n u a l l y   b y   c h a n g i n g   t h e   v a l u e   o f   t h i s   f i e l d .   H o w e v e r ,   y o u   u s u a l l y   d o n ' t   n e e d   t o   a n d   c a n   a l l o w   K u b e r n e t e s   t o   a u t o m a t i c a l l y   m a n a g e   t h e   r e l a t i o n s h i p s .   D e p e n d e n t   o b j e c t s   a l s o   h a v e   a n   o w n e r R e f e r e n c e s . b l o c k O w n e r D e l e t i o n   f i e l d   t h a t   t a k e s   a   b o o l e a n   v a l u e   a n d   c o n t r o l s   w h e t h e r   s p e c i f i c   d e p e n d e n t s   c a n   b l o c k   g a r b a g e   c o l l e c t i o n   f r o m   d e l e t i n g   t h e i r   o w n e r   o b j e c t .   K u b e r n e t e s   a u t o m a t i c a l l y   s e t s   t h i s   f i e l d   t o   t r u e   i f   a   c o n t r o l l e r   ( f o r   e x a m p l e ,   t h e   D e p l o y m e n t   c o n t r o l l e r )   s e t s   t h e   v a l u e   o f   t h e   m e t a d a t a . o w n e r R e f e r e n c e s   f i e l d .   Y o u   c a n   a l s o   s e t   t h e   v a l u e   o f   t h e   b l o c k O w n e r D e l


Question: What is Note:?

Answer: C r o s s - n a m e s p a c e   o w n e r   r e f e r e n c e s   a r e   d i s a l l o w e d   b y   d e s i g n .   N a m e s p a c e d   d e p e n d e n t s   c a n   s p e c i f y   c l u s t e r - s c o p e d   o r   n a m e s p a c e d   o w n e r s .   A   n a m e s p a c e d   o w n e r   m u s t   e x i s t   i n   t h e   s a m e   n a m e s p a c e   a s   t h e   d e p e n d e n t .   I f   i t   d o e s   n o t ,   t h e   o w n e r   r e f e r e n c e   i s   t r e a t e d   a s   a b s e n t ,   a n d   t h e   d e p e n d e n t   i s   s u b j e c t   t o   d e l e t i o n   o n c e   a l l   o w n e r s   a r e   v e r i f i e d   a b s e n t .   C l u s t e r - s c o p e d   d e p e n d e n t s   c a n   o n l y   s p e c i f y   c l u s t e r - s c o p e d   o w n e r s .   I n   v 1 . 2 0 + ,   i f   a   c l u s t e r - s c o p e d   d e p e n d e n t   s p e c i f i e s   a   n a m e s p a c e d   k i n d   a s   a n   o w n e r ,   i t   i s   t r e a t e d   a s   h a v i n g   a n   u n r e s o l v a b l e   o w n e r   r e f e r e n c e ,   a n d   i s   n o t   a b l e   t o   b e   g a r b a g e   c o l l e c t e d .   I n   v 1 . 2 0 + ,   i f   t h e   g a r b a g e   c o l l e c t o r   d e t e c t s   a n   i n v a l i d   c r o s s - n a m e s p a c e   o w n e r R e f e r e n c e ,   o r   a   c l u s t e r - s c o p e d   d e p e n d e n t   w i t h   a n   o w n e r R e f e r e n c e   r e f e r e n c i n g   a   n a m e s p a c e d   k i n d ,   a   w a r n i n g   E v e n t   w i t h   a   r e a s o n   o f   O w n e r R e f I n v a l i d N a m e s p a c e   a n d   a n   i n v o l v e d O b j e c t   o f   t h e   i n v a l i d   d e p e n d e n t   i s   r e p o r t e d .   Y o u   c a n   c h e c k   f o r   t h a t   k i n d   o f   E v e n t   b y   r u n n i n g   k u b e c t l   g e t   e v e n t s   - A   - - f i e l d - s e l e c t o r = r e a s o n = O w n e r R e f I n v a l i d N a m e s p a c e .


Question: What is Ownership and finalizers?

Answer: W h e n   y o u   t e l l   K u b e r n e t e s   t o   d e l e t e   a   r e s o u r c e ,   t h e   A P I   s e r v e r   a l l o w s   t h e   m a n a g i n g   c o n t r o l l e r   t o   p r o c e s s   a n y   f i n a l i z e r   r u l e s   f o r   t h e   r e s o u r c e .   F i n a l i z e r s   p r e v e n t   a c c i d e n t a l   d e l e t i o n   o f   r e s o u r c e s   y o u r   c l u s t e r   m a y   s t i l l   n e e d   t o   f u n c t i o n   c o r r e c t l y .   F o r   e x a m p l e ,   i f   y o u   t r y   t o   d e l e t e   a   P e r s i s t e n t V o l u m e   t h a t   i s   s t i l l   i n   u s e   b y   a   P o d ,   t h e   d e l e t i o n   d o e s   n o t   h a p p e n   i m m e d i a t e l y   b e c a u s e   t h e   P e r s i s t e n t V o l u m e   h a s   t h e   k u b e r n e t e s . i o / p v - p r o t e c t i o n   f i n a l i z e r   o n   i t .   I n s t e a d ,   t h e   v o l u m e   r e m a i n s   i n   t h e   T e r m i n a t i n g   s t a t u s   u n t i l   K u b e r n e t e s   c l e a r s   t h e   f i n a l i z e r ,   w h i c h   o n l y   h a p p e n s   a f t e r   t h e   P e r s i s t e n t V o l u m e   i s   n o   l o n g e r   b o u n d   t o   a   P o d .   K u b e r n e t e s   a l s o   a d d s   f i n a l i z e r s   t o   a n   o w n e r   r e s o u r c e   w h e n   y o u   u s e   e i t h e r   f o r e g r o u n d   o r   o r p h a n   c a s c a d i n g   d e l e t i o n .   I n   f o r e g r o u n d   d e l e t i o n ,   i t   a d d s   t h e   f o r e g r o u n d   f i n a l i z e r   s o   t h a t   t h e   c o n t r o l l e r   m u s t   d e l e t e   d e p e n d e n t   r e s o u r c e s   t h a t   a l s o   h a v e   o w n e r R e f e r e n c e s . b l o c k O w n e r D e l e t i o n = t r u e   b e f o r e   i t   d e l e t e s   t h e   o w n e r .   I f   y o u   s p e c i f y   a n   o r p h a n   d e l e t i o n   p o l i c y ,   K u b e r n e t e s   a d d s   t h e   o r p h a n   f


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   K u b e r n e t e s   f i n a l i z e r s . L e a r n   a b o u t   g a r b a g e   c o l l e c t i o n . R e a d   t h e   A P I   r e f e r e n c e   f o r   o b j e c t   m e t a d a t a .


Question: What is Device Plugins?

Answer: Device PluginsDevice plugins let you configure your cluster with support for devices or resources that require vendor-specific setup, such as GPUs, NICs, FPGAs, or non-volatile main memory.FEATURE STATE: Kubernetes v1.26 [stable]Kubernetes provides a device plugin framework that you can use to advertise system hardware resources to the Kubelet.Instead of customizing the code for Kubernetes itself, vendors can implement a device plugin that you deploy either manually or as a DaemonSet. The targeted devices include GPUs, high-performance NICs, FPGAs, InfiniBand adapters, and other similar computing resources that may require vendor specific initialization and setup.Device plugin registrationThe kubelet exports a Registration gRPC service:service Registration { rpc Register(RegisterRequest) returns (Empty) {} } A device plugin can register itself with the kubelet through this gRPC service. During the registration, the device plugin needs to send:The name of its Unix socket.The Device Plugin API version against which it was built.The ResourceName it wants to advertise. Here ResourceName needs to follow the extended resource naming scheme as vendor-domain/resourcetype. (For example, an NVIDIA GPU is advertised as nvidia.com/gpu.)Following a successful registration, the device plugin sends the kubelet the list of devices it manages, and the kubelet is then in charge of advertising those resources to the API server as part of the kubelet node status update. For example, after a device plugin registers hardware-vendor.example/foo with the kubelet and reports two healthy devices on a node, the node status is updated to advertise that the node has 2 "Foo" devices installed and available.Then, users can request devices as part of a Pod specification (see container). Requesting extended resources is similar to how you manage requests and limits for other resources, with the following differences:Extended resources are only supported as integer resources and cannot be overcommitted.Devices cannot be shared between containers.ExampleSuppose a Kubernetes cluster is running a device plugin that advertises resource hardware-vendor.example/foo on certain nodes. Here is an example of a pod requesting this resource to run a demo workload:--- apiVersion: v1 kind: Pod metadata: name: demo-pod spec: containers: - name: demo-container-1 image: registry.k8s.io/pause:3.8 resources: limits: hardware-vendor.example/foo: 2 # # This Pod needs 2 of the hardware-vendor.example/foo devices # and can only schedule onto a Node that's able to satisfy # that need. # # If the Node has more than 2 of those devices available, the # remainder would be available for other Pods to use. Device plugin implementationThe general workflow of a device plugin includes the following steps:Initialization. During this phase, the device plugin performs vendor-specific initialization and setup to make sure the devices are in a ready state.The plugin starts a gRPC service, with a Unix socket under the


Question: How does Device Plugins work?

Answer: Device PluginsDevice plugins let you configure your cluster with support for devices or resources that require vendor-specific setup, such as GPUs, NICs, FPGAs, or non-volatile main memory.FEATURE STATE: Kubernetes v1.26 [stable]Kubernetes provides a device plugin framework that you can use to advertise system hardware resources to the Kubelet.Instead of customizing the code for Kubernetes itself, vendors can implement a device plugin that you deploy either manually or as a DaemonSet. The targeted devices include GPUs, high-performance NICs, FPGAs, InfiniBand adapters, and other similar computing resources that may require vendor specific initialization and setup.Device plugin registrationThe kubelet exports a Registration gRPC service:service Registration { rpc Register(RegisterRequest) returns (Empty) {} } A device plugin can register itself with the kubelet through this gRPC service. During the registration, the device plugin needs to send:The name of its Unix socket.The Device Plugin API version against which it was built.The ResourceName it wants to advertise. Here ResourceName needs to follow the extended resource naming scheme as vendor-domain/resourcetype. (For example, an NVIDIA GPU is advertised as nvidia.com/gpu.)Following a successful registration, the device plugin sends the kubelet the list of devices it manages, and the kubelet is then in charge of advertising those resources to the API server as part of the kubelet node status update. For example, after a device plugin registers hardware-vendor.example/foo with the kubelet and reports two healthy devices on a node, the node status is updated to advertise that the node has 2 "Foo" devices installed and available.Then, users can request devices as part of a Pod specification (see container). Requesting extended resources is similar to how you manage requests and limits for other resources, with the following differences:Extended resources are only supported as integer resources and cannot be overcommitted.Devices cannot be shared between containers.ExampleSuppose a Kubernetes cluster is running a device plugin that advertises resource hardware-vendor.example/foo on certain nodes. Here is an example of a pod requesting this resource to run a demo workload:--- apiVersion: v1 kind: Pod metadata: name: demo-pod spec: containers: - name: demo-container-1 image: registry.k8s.io/pause:3.8 resources: limits: hardware-vendor.example/foo: 2 # # This Pod needs 2 of the hardware-vendor.example/foo devices # and can only schedule onto a Node that's able to satisfy # that need. # # If the Node has more than 2 of those devices available, the # remainder would be available for other Pods to use. Device plugin implementationThe general workflow of a device plugin includes the following steps:Initialization. During this phase, the device plugin performs vendor-specific initialization and setup to make sure the devices are in a ready state.The plugin starts a gRPC service, with a Unix socket under the


Question: When would you use Device Plugins?

Answer: Device PluginsDevice plugins let you configure your cluster with support for devices or resources that require vendor-specific setup, such as GPUs, NICs, FPGAs, or non-volatile main memory.FEATURE STATE: Kubernetes v1.26 [stable]Kubernetes provides a device plugin framework that you can use to advertise system hardware resources to the Kubelet.Instead of customizing the code for Kubernetes itself, vendors can implement a device plugin that you deploy either manually or as a DaemonSet. The targeted devices include GPUs, high-performance NICs, FPGAs, InfiniBand adapters, and other similar computing resources that may require vendor specific initialization and setup.Device plugin registrationThe kubelet exports a Registration gRPC service:service Registration { rpc Register(RegisterRequest) returns (Empty) {} } A device plugin can register itself with the kubelet through this gRPC service. During the registration, the device plugin needs to send:The name of its Unix socket.The Device Plugin API version against which it was built.The ResourceName it wants to advertise. Here ResourceName needs to follow the extended resource naming scheme as vendor-domain/resourcetype. (For example, an NVIDIA GPU is advertised as nvidia.com/gpu.)Following a successful registration, the device plugin sends the kubelet the list of devices it manages, and the kubelet is then in charge of advertising those resources to the API server as part of the kubelet node status update. For example, after a device plugin registers hardware-vendor.example/foo with the kubelet and reports two healthy devices on a node, the node status is updated to advertise that the node has 2 "Foo" devices installed and available.Then, users can request devices as part of a Pod specification (see container). Requesting extended resources is similar to how you manage requests and limits for other resources, with the following differences:Extended resources are only supported as integer resources and cannot be overcommitted.Devices cannot be shared between containers.ExampleSuppose a Kubernetes cluster is running a device plugin that advertises resource hardware-vendor.example/foo on certain nodes. Here is an example of a pod requesting this resource to run a demo workload:--- apiVersion: v1 kind: Pod metadata: name: demo-pod spec: containers: - name: demo-container-1 image: registry.k8s.io/pause:3.8 resources: limits: hardware-vendor.example/foo: 2 # # This Pod needs 2 of the hardware-vendor.example/foo devices # and can only schedule onto a Node that's able to satisfy # that need. # # If the Node has more than 2 of those devices available, the # remainder would be available for other Pods to use. Device plugin implementationThe general workflow of a device plugin includes the following steps:Initialization. During this phase, the device plugin performs vendor-specific initialization and setup to make sure the devices are in a ready state.The plugin starts a gRPC service, with a Unix socket under the


Question: What are the benefits of Device Plugins?

Answer: Device PluginsDevice plugins let you configure your cluster with support for devices or resources that require vendor-specific setup, such as GPUs, NICs, FPGAs, or non-volatile main memory.FEATURE STATE: Kubernetes v1.26 [stable]Kubernetes provides a device plugin framework that you can use to advertise system hardware resources to the Kubelet.Instead of customizing the code for Kubernetes itself, vendors can implement a device plugin that you deploy either manually or as a DaemonSet. The targeted devices include GPUs, high-performance NICs, FPGAs, InfiniBand adapters, and other similar computing resources that may require vendor specific initialization and setup.Device plugin registrationThe kubelet exports a Registration gRPC service:service Registration { rpc Register(RegisterRequest) returns (Empty) {} } A device plugin can register itself with the kubelet through this gRPC service. During the registration, the device plugin needs to send:The name of its Unix socket.The Device Plugin API version against which it was built.The ResourceName it wants to advertise. Here ResourceName needs to follow the extended resource naming scheme as vendor-domain/resourcetype. (For example, an NVIDIA GPU is advertised as nvidia.com/gpu.)Following a successful registration, the device plugin sends the kubelet the list of devices it manages, and the kubelet is then in charge of advertising those resources to the API server as part of the kubelet node status update. For example, after a device plugin registers hardware-vendor.example/foo with the kubelet and reports two healthy devices on a node, the node status is updated to advertise that the node has 2 "Foo" devices installed and available.Then, users can request devices as part of a Pod specification (see container). Requesting extended resources is similar to how you manage requests and limits for other resources, with the following differences:Extended resources are only supported as integer resources and cannot be overcommitted.Devices cannot be shared between containers.ExampleSuppose a Kubernetes cluster is running a device plugin that advertises resource hardware-vendor.example/foo on certain nodes. Here is an example of a pod requesting this resource to run a demo workload:--- apiVersion: v1 kind: Pod metadata: name: demo-pod spec: containers: - name: demo-container-1 image: registry.k8s.io/pause:3.8 resources: limits: hardware-vendor.example/foo: 2 # # This Pod needs 2 of the hardware-vendor.example/foo devices # and can only schedule onto a Node that's able to satisfy # that need. # # If the Node has more than 2 of those devices available, the # remainder would be available for other Pods to use. Device plugin implementationThe general workflow of a device plugin includes the following steps:Initialization. During this phase, the device plugin performs vendor-specific initialization and setup to make sure the devices are in a ready state.The plugin starts a gRPC service, with a Unix socket under the


Question: What is Device Plugins?

Answer: K u b e r n e t e s   p r o v i d e s   a   d e v i c e   p l u g i n   f r a m e w o r k   t h a t   y o u   c a n   u s e   t o   a d v e r t i s e   s y s t e m   h a r d w a r e   r e s o u r c e s   t o   t h e   K u b e l e t .   I n s t e a d   o f   c u s t o m i z i n g   t h e   c o d e   f o r   K u b e r n e t e s   i t s e l f ,   v e n d o r s   c a n   i m p l e m e n t   a   d e v i c e   p l u g i n   t h a t   y o u   d e p l o y   e i t h e r   m a n u a l l y   o r   a s   a   D a e m o n S e t .   T h e   t a r g e t e d   d e v i c e s   i n c l u d e   G P U s ,   h i g h - p e r f o r m a n c e   N I C s ,   F P G A s ,   I n f i n i B a n d   a d a p t e r s ,   a n d   o t h e r   s i m i l a r   c o m p u t i n g   r e s o u r c e s   t h a t   m a y   r e q u i r e   v e n d o r   s p e c i f i c   i n i t i a l i z a t i o n   a n d   s e t u p .


Question: What is Device plugin registration?

Answer: T h e   k u b e l e t   e x p o r t s   a   R e g i s t r a t i o n   g R P C   s e r v i c e :   s e r v i c e   R e g i s t r a t i o n   {   r p c   R e g i s t e r ( R e g i s t e r R e q u e s t )   r e t u r n s   ( E m p t y )   { }   }   A   d e v i c e   p l u g i n   c a n   r e g i s t e r   i t s e l f   w i t h   t h e   k u b e l e t   t h r o u g h   t h i s   g R P C   s e r v i c e .   D u r i n g   t h e   r e g i s t r a t i o n ,   t h e   d e v i c e   p l u g i n   n e e d s   t o   s e n d :   T h e   n a m e   o f   i t s   U n i x   s o c k e t . T h e   D e v i c e   P l u g i n   A P I   v e r s i o n   a g a i n s t   w h i c h   i t   w a s   b u i l t . T h e   R e s o u r c e N a m e   i t   w a n t s   t o   a d v e r t i s e .   H e r e   R e s o u r c e N a m e   n e e d s   t o   f o l l o w   t h e   e x t e n d e d   r e s o u r c e   n a m i n g   s c h e m e   a s   v e n d o r - d o m a i n / r e s o u r c e t y p e .   ( F o r   e x a m p l e ,   a n   N V I D I A   G P U   i s   a d v e r t i s e d   a s   n v i d i a . c o m / g p u . )   F o l l o w i n g   a   s u c c e s s f u l   r e g i s t r a t i o n ,   t h e   d e v i c e   p l u g i n   s e n d s   t h e   k u b e l e t   t h e   l i s t   o f   d e v i c e s   i t   m a n a g e s ,   a n d   t h e   k u b e l e t   i s   t h e n   i n   c h a r g e   o f   a d v e r t i s i n g   t h o s e   r e s o u r c e s   t o   t h e   A P I   s e r v e r   a s   p a r t   o f   t h e   k u b e l e t   n o d e   s t a t u s   u p d a t e .   F o r   e x a m p l e ,   a f t e r   a   d e v i c e   p l u g i n   r e g i s t e r s   h a r d w a r e - v e n d o r . e x a m p l e / f o o   w i t h   t h e   k u b e l e t   a n d   r e p o r t s   t w o   h e a l t h y   d e v i c e s   o n   a   n o d e ,   t h e   n o d e   s t a t u s   i s   u p d a t e d   t o   a d v e r t i s e   t h a t   t h e   n o d e   h a s   2   " F o o "   d e v i c e s   i n s t a l l e d   a n d


Question: What is Example?

Answer: S u p p o s e   a   K u b e r n e t e s   c l u s t e r   i s   r u n n i n g   a   d e v i c e   p l u g i n   t h a t   a d v e r t i s e s   r e s o u r c e   h a r d w a r e - v e n d o r . e x a m p l e / f o o   o n   c e r t a i n   n o d e s .   H e r e   i s   a n   e x a m p l e   o f   a   p o d   r e q u e s t i n g   t h i s   r e s o u r c e   t o   r u n   a   d e m o   w o r k l o a d :   - - -   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   d e m o - p o d   s p e c :   c o n t a i n e r s :   -   n a m e :   d e m o - c o n t a i n e r - 1   i m a g e :   r e g i s t r y . k 8 s . i o / p a u s e : 3 . 8   r e s o u r c e s :   l i m i t s :   h a r d w a r e - v e n d o r . e x a m p l e / f o o :   2   #   #   T h i s   P o d   n e e d s   2   o f   t h e   h a r d w a r e - v e n d o r . e x a m p l e / f o o   d e v i c e s   #   a n d   c a n   o n l y   s c h e d u l e   o n t o   a   N o d e   t h a t ' s   a b l e   t o   s a t i s f y   #   t h a t   n e e d .   #   #   I f   t h e   N o d e   h a s   m o r e   t h a n   2   o f   t h o s e   d e v i c e s   a v a i l a b l e ,   t h e   #   r e m a i n d e r   w o u l d   b e   a v a i l a b l e   f o r   o t h e r   P o d s   t o   u s e .


Question: What is Device plugin implementation?

Answer: T h e   g e n e r a l   w o r k f l o w   o f   a   d e v i c e   p l u g i n   i n c l u d e s   t h e   f o l l o w i n g   s t e p s :   I n i t i a l i z a t i o n .   D u r i n g   t h i s   p h a s e ,   t h e   d e v i c e   p l u g i n   p e r f o r m s   v e n d o r - s p e c i f i c   i n i t i a l i z a t i o n   a n d   s e t u p   t o   m a k e   s u r e   t h e   d e v i c e s   a r e   i n   a   r e a d y   s t a t e . T h e   p l u g i n   s t a r t s   a   g R P C   s e r v i c e ,   w i t h   a   U n i x   s o c k e t   u n d e r   t h e   h o s t   p a t h   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s / ,   t h a t   i m p l e m e n t s   t h e   f o l l o w i n g   i n t e r f a c e s : s e r v i c e   D e v i c e P l u g i n   {   / /   G e t D e v i c e P l u g i n O p t i o n s   r e t u r n s   o p t i o n s   t o   b e   c o m m u n i c a t e d   w i t h   D e v i c e   M a n a g e r .   r p c   G e t D e v i c e P l u g i n O p t i o n s ( E m p t y )   r e t u r n s   ( D e v i c e P l u g i n O p t i o n s )   { }   / /   L i s t A n d W a t c h   r e t u r n s   a   s t r e a m   o f   L i s t   o f   D e v i c e s   / /   W h e n e v e r   a   D e v i c e   s t a t e   c h a n g e   o r   a   D e v i c e   d i s a p p e a r s ,   L i s t A n d W a t c h   / /   r e t u r n s   t h e   n e w   l i s t   r p c   L i s t A n d W a t c h ( E m p t y )   r e t u r n s   ( s t r e a m   L i s t A n d W a t c h R e s p o n s e )   { }   / /   A l l o c a t e   i s   c a l l e d   d u r i n g   c o n t a i n e r   c r e a t i o n   s o   t h a t   t h e   D e v i c e   / /   P l u g i n   c a n   r u n   d e v i c e   s p e c i f i c   o p e r a t i o n s   a n d   i n s t r u c t   K u b e l e t   / /   o f   t h e   s t e p s   t o   m a k e   t h e   D e v i c e   a v a i l a b l e   i n   t h e   c o n t a i n e r   r p c   A l l o c a t e ( A l l o c a t e R e q u e s t )   r e t u r n s   ( A l l o c a t e R e s p o n s


Question: What is Note:?

Answer: T h e   p l u g i n   r e g i s t e r s   i t s e l f   w i t h   t h e   k u b e l e t   t h r o u g h   t h e   U n i x   s o c k e t   a t   h o s t   p a t h   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s / k u b e l e t . s o c k .


Question: What is Note:?

Answer: A f t e r   s u c c e s s f u l l y   r e g i s t e r i n g   i t s e l f ,   t h e   d e v i c e   p l u g i n   r u n s   i n   s e r v i n g   m o d e ,   d u r i n g   w h i c h   i t   k e e p s   m o n i t o r i n g   d e v i c e   h e a l t h   a n d   r e p o r t s   b a c k   t o   t h e   k u b e l e t   u p o n   a n y   d e v i c e   s t a t e   c h a n g e s .   I t   i s   a l s o   r e s p o n s i b l e   f o r   s e r v i n g   A l l o c a t e   g R P C   r e q u e s t s .   D u r i n g   A l l o c a t e ,   t h e   d e v i c e   p l u g i n   m a y   d o   d e v i c e - s p e c i f i c   p r e p a r a t i o n ;   f o r   e x a m p l e ,   G P U   c l e a n u p   o r   Q R N G   i n i t i a l i z a t i o n .   I f   t h e   o p e r a t i o n s   s u c c e e d ,   t h e   d e v i c e   p l u g i n   r e t u r n s   a n   A l l o c a t e R e s p o n s e   t h a t   c o n t a i n s   c o n t a i n e r   r u n t i m e   c o n f i g u r a t i o n s   f o r   a c c e s s i n g   t h e   a l l o c a t e d   d e v i c e s .   T h e   k u b e l e t   p a s s e s   t h i s   i n f o r m a t i o n   t o   t h e   c o n t a i n e r   r u n t i m e .   A n   A l l o c a t e R e s p o n s e   c o n t a i n s   z e r o   o r   m o r e   C o n t a i n e r A l l o c a t e R e s p o n s e   o b j e c t s .   I n   t h e s e ,   t h e   d e v i c e   p l u g i n   d e f i n e s   m o d i f i c a t i o n s   t h a t   m u s t   b e   m a d e   t o   a   c o n t a i n e r ' s   d e f i n i t i o n   t o   p r o v i d e   a c c e s s   t o   t h e   d e v i c e .   T h e s e   m o d i f i c a t i o n s   i n c l u d e :   A n n o t a t i o n s d e v i c e   n o d e s e n v i r o n m e n t   v a r i a b l e s m o u n t s f u l l y - q u a l i f i e d   C D I   d e v i c e   n a m e s


Question: What is Handling kubelet restarts?

Answer: A   d e v i c e   p l u g i n   i s   e x p e c t e d   t o   d e t e c t   k u b e l e t   r e s t a r t s   a n d   r e - r e g i s t e r   i t s e l f   w i t h   t h e   n e w   k u b e l e t   i n s t a n c e .   A   n e w   k u b e l e t   i n s t a n c e   d e l e t e s   a l l   t h e   e x i s t i n g   U n i x   s o c k e t s   u n d e r   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s   w h e n   i t   s t a r t s .   A   d e v i c e   p l u g i n   c a n   m o n i t o r   t h e   d e l e t i o n   o f   i t s   U n i x   s o c k e t   a n d   r e - r e g i s t e r   i t s e l f   u p o n   s u c h   a n   e v e n t .


Question: What is Device plugin and unhealthy devices?

Answer: T h e r e   a r e   c a s e s   w h e n   d e v i c e s   f a i l   o r   a r e   s h u t   d o w n .   T h e   r e s p o n s i b i l i t y   o f   t h e   D e v i c e   P l u g i n   i n   t h i s   c a s e   i s   t o   n o t i f y   t h e   k u b e l e t   a b o u t   t h e   s i t u a t i o n   u s i n g   t h e   L i s t A n d W a t c h R e s p o n s e   A P I .   O n c e   a   d e v i c e   i s   m a r k e d   a s   u n h e a l t h y ,   t h e   k u b e l e t   w i l l   d e c r e a s e   t h e   a l l o c a t a b l e   c o u n t   f o r   t h i s   r e s o u r c e   o n   t h e   N o d e   t o   r e f l e c t   h o w   m a n y   d e v i c e s   c a n   b e   u s e d   f o r   s c h e d u l i n g   n e w   p o d s .   C a p a c i t y   c o u n t   f o r   t h e   r e s o u r c e   w i l l   n o t   c h a n g e .   P o d s   t h a t   w e r e   a s s i g n e d   t o   t h e   f a i l e d   d e v i c e s   w i l l   c o n t i n u e   b e   a s s i g n e d   t o   t h i s   d e v i c e .   I t   i s   t y p i c a l   t h a t   c o d e   r e l y i n g   o n   t h e   d e v i c e   w i l l   s t a r t   f a i l i n g   a n d   P o d   m a y   g e t   i n t o   F a i l e d   p h a s e   i f   r e s t a r t P o l i c y   f o r   t h e   P o d   w a s   n o t   A l w a y s   o r   e n t e r   t h e   c r a s h   l o o p   o t h e r w i s e .   B e f o r e   K u b e r n e t e s   v 1 . 3 1 ,   t h e   w a y   t o   k n o w   w h e t h e r   o r   n o t   a   P o d   i s   a s s o c i a t e d   w i t h   t h e   f a i l e d   d e v i c e   i s   t o   u s e   t h e   P o d R e s o u r c e s   A P I .   B y   e n a b l i n g   t h e   f e a t u r e   g a t e   R e s o u r c e H e a l t h S t a t u s ,   t h e   f i e l d   a l l o c a t e d R e s o u r c e s S t a t u s   w i l l   b e   a d d e d   t o   e a c h   c o n t a i n e r   s t a t u s ,   w i t h i n   t h e   . s t a t u s   f o r   e a c h   P o d .   T h e   a l l o c a t e d R e s o u r c e s S t a t u s


Question: What is Device plugin deployment?

Answer: Y o u   c a n   d e p l o y   a   d e v i c e   p l u g i n   a s   a   D a e m o n S e t ,   a s   a   p a c k a g e   f o r   y o u r   n o d e ' s   o p e r a t i n g   s y s t e m ,   o r   m a n u a l l y .   T h e   c a n o n i c a l   d i r e c t o r y   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s   r e q u i r e s   p r i v i l e g e d   a c c e s s ,   s o   a   d e v i c e   p l u g i n   m u s t   r u n   i n   a   p r i v i l e g e d   s e c u r i t y   c o n t e x t .   I f   y o u ' r e   d e p l o y i n g   a   d e v i c e   p l u g i n   a s   a   D a e m o n S e t ,   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s   m u s t   b e   m o u n t e d   a s   a   V o l u m e   i n   t h e   p l u g i n ' s   P o d S p e c .   I f   y o u   c h o o s e   t h e   D a e m o n S e t   a p p r o a c h   y o u   c a n   r e l y   o n   K u b e r n e t e s   t o :   p l a c e   t h e   d e v i c e   p l u g i n ' s   P o d   o n t o   N o d e s ,   t o   r e s t a r t   t h e   d a e m o n   P o d   a f t e r   f a i l u r e ,   a n d   t o   h e l p   a u t o m a t e   u p g r a d e s .


Question: What is API compatibility?

Answer: P r e v i o u s l y ,   t h e   v e r s i o n i n g   s c h e m e   r e q u i r e d   t h e   D e v i c e   P l u g i n ' s   A P I   v e r s i o n   t o   m a t c h   e x a c t l y   t h e   K u b e l e t ' s   v e r s i o n .   S i n c e   t h e   g r a d u a t i o n   o f   t h i s   f e a t u r e   t o   B e t a   i n   v 1 . 1 2   t h i s   i s   n o   l o n g e r   a   h a r d   r e q u i r e m e n t .   T h e   A P I   i s   v e r s i o n e d   a n d   h a s   b e e n   s t a b l e   s i n c e   B e t a   g r a d u a t i o n   o f   t h i s   f e a t u r e .   B e c a u s e   o f   t h i s ,   k u b e l e t   u p g r a d e s   s h o u l d   b e   s e a m l e s s   b u t   t h e r e   s t i l l   m a y   b e   c h a n g e s   i n   t h e   A P I   b e f o r e   s t a b i l i z a t i o n   m a k i n g   u p g r a d e s   n o t   g u a r a n t e e d   t o   b e   n o n - b r e a k i n g .


Question: What is Note:?

Answer: A s   a   p r o j e c t ,   K u b e r n e t e s   r e c o m m e n d s   t h a t   d e v i c e   p l u g i n   d e v e l o p e r s :   W a t c h   f o r   D e v i c e   P l u g i n   A P I   c h a n g e s   i n   t h e   f u t u r e   r e l e a s e s . S u p p o r t   m u l t i p l e   v e r s i o n s   o f   t h e   d e v i c e   p l u g i n   A P I   f o r   b a c k w a r d / f o r w a r d   c o m p a t i b i l i t y .   T o   r u n   d e v i c e   p l u g i n s   o n   n o d e s   t h a t   n e e d   t o   b e   u p g r a d e d   t o   a   K u b e r n e t e s   r e l e a s e   w i t h   a   n e w e r   d e v i c e   p l u g i n   A P I   v e r s i o n ,   u p g r a d e   y o u r   d e v i c e   p l u g i n s   t o   s u p p o r t   b o t h   v e r s i o n s   b e f o r e   u p g r a d i n g   t h e s e   n o d e s .   T a k i n g   t h a t   a p p r o a c h   w i l l   e n s u r e   t h e   c o n t i n u o u s   f u n c t i o n i n g   o f   t h e   d e v i c e   a l l o c a t i o n s   d u r i n g   t h e   u p g r a d e .


Question: What is Monitoring device plugin resources?

Answer: I n   o r d e r   t o   m o n i t o r   r e s o u r c e s   p r o v i d e d   b y   d e v i c e   p l u g i n s ,   m o n i t o r i n g   a g e n t s   n e e d   t o   b e   a b l e   t o   d i s c o v e r   t h e   s e t   o f   d e v i c e s   t h a t   a r e   i n - u s e   o n   t h e   n o d e   a n d   o b t a i n   m e t a d a t a   t o   d e s c r i b e   w h i c h   c o n t a i n e r   t h e   m e t r i c   s h o u l d   b e   a s s o c i a t e d   w i t h .   P r o m e t h e u s   m e t r i c s   e x p o s e d   b y   d e v i c e   m o n i t o r i n g   a g e n t s   s h o u l d   f o l l o w   t h e   K u b e r n e t e s   I n s t r u m e n t a t i o n   G u i d e l i n e s ,   i d e n t i f y i n g   c o n t a i n e r s   u s i n g   p o d ,   n a m e s p a c e ,   a n d   c o n t a i n e r   p r o m e t h e u s   l a b e l s .   T h e   k u b e l e t   p r o v i d e s   a   g R P C   s e r v i c e   t o   e n a b l e   d i s c o v e r y   o f   i n - u s e   d e v i c e s ,   a n d   t o   p r o v i d e   m e t a d a t a   f o r   t h e s e   d e v i c e s :   / /   P o d R e s o u r c e s L i s t e r   i s   a   s e r v i c e   p r o v i d e d   b y   t h e   k u b e l e t   t h a t   p r o v i d e s   i n f o r m a t i o n   a b o u t   t h e   / /   n o d e   r e s o u r c e s   c o n s u m e d   b y   p o d s   a n d   c o n t a i n e r s   o n   t h e   n o d e   s e r v i c e   P o d R e s o u r c e s L i s t e r   {   r p c   L i s t ( L i s t P o d R e s o u r c e s R e q u e s t )   r e t u r n s   ( L i s t P o d R e s o u r c e s R e s p o n s e )   { }   r p c   G e t A l l o c a t a b l e R e s o u r c e s ( A l l o c a t a b l e R e s o u r c e s R e q u e s t )   r e t u r n s   ( A l l o c a t a b l e R e s o u r c e s R e s p o n s e )   { }   r p c   G e t ( G e t P o d R e s o u r c e s R e q u e s t )   r e t u r n s   ( G e t P o d R e s o u r c e s R e s p o n s e )   { }   }


Question: What is List gRPC endpoint?

Answer: T h e   L i s t   e n d p o i n t   p r o v i d e s   i n f o r m a t i o n   o n   r e s o u r c e s   o f   r u n n i n g   p o d s ,   w i t h   d e t a i l s   s u c h   a s   t h e   i d   o f   e x c l u s i v e l y   a l l o c a t e d   C P U s ,   d e v i c e   i d   a s   i t   w a s   r e p o r t e d   b y   d e v i c e   p l u g i n s   a n d   i d   o f   t h e   N U M A   n o d e   w h e r e   t h e s e   d e v i c e s   a r e   a l l o c a t e d .   A l s o ,   f o r   N U M A - b a s e d   m a c h i n e s ,   i t   c o n t a i n s   t h e   i n f o r m a t i o n   a b o u t   m e m o r y   a n d   h u g e p a g e s   r e s e r v e d   f o r   a   c o n t a i n e r .   S t a r t i n g   f r o m   K u b e r n e t e s   v 1 . 2 7 ,   t h e   L i s t   e n d p o i n t   c a n   p r o v i d e   i n f o r m a t i o n   o n   r e s o u r c e s   o f   r u n n i n g   p o d s   a l l o c a t e d   i n   R e s o u r c e C l a i m s   b y   t h e   D y n a m i c R e s o u r c e A l l o c a t i o n   A P I .   S t a r t i n g   f r o m   K u b e r n e t e s   v 1 . 3 4 ,   t h i s   f e a t u r e   i s   e n a b l e d   b y   d e f a u l t .   T o   d i s a b l e ,   k u b e l e t   m u s t   b e   s t a r t e d   w i t h   t h e   f o l l o w i n g   f l a g s :   - - f e a t u r e - g a t e s = K u b e l e t P o d R e s o u r c e s D y n a m i c R e s o u r c e s = f a l s e   / /   L i s t P o d R e s o u r c e s R e s p o n s e   i s   t h e   r e s p o n s e   r e t u r n e d   b y   L i s t   f u n c t i o n   m e s s a g e   L i s t P o d R e s o u r c e s R e s p o n s e   {   r e p e a t e d   P o d R e s o u r c e s   p o d _ r e s o u r c e s   =   1 ;   }   / /   P o d R e s o u r c e s   c o n t a i n s   i n f o r m a t i o n   a b o u t   t h e   n o d e   r e s o u r c e s   a s s i g n e d   t o   a   p o d   m e s s a g e   P o d R e s o u r c e s   {   s t r i n g   n a m e   =   1 ;   s t r i n g   n a m e s p a c e   =   2 ;   r e p e a t e


Question: What is Note:?

Answer: c p u _ i d s   i n   t h e   C o n t a i n e r R e s o u r c e s   i n   t h e   L i s t   e n d p o i n t   c o r r e s p o n d   t o   e x c l u s i v e   C P U s   a l l o c a t e d   t o   a   p a r t i c u l a r   c o n t a i n e r .   I f   t h e   g o a l   i s   t o   e v a l u a t e   C P U s   t h a t   b e l o n g   t o   t h e   s h a r e d   p o o l ,   t h e   L i s t   e n d p o i n t   n e e d s   t o   b e   u s e d   i n   c o n j u n c t i o n   w i t h   t h e   G e t A l l o c a t a b l e R e s o u r c e s   e n d p o i n t   a s   e x p l a i n e d   b e l o w :   C a l l   G e t A l l o c a t a b l e R e s o u r c e s   t o   g e t   a   l i s t   o f   a l l   t h e   a l l o c a t a b l e   C P U s C a l l   G e t C p u I d s   o n   a l l   C o n t a i n e r R e s o u r c e s   i n   t h e   s y s t e m S u b t r a c t   o u t   a l l   o f   t h e   C P U s   f r o m   t h e   G e t C p u I d s   c a l l s   f r o m   t h e   G e t A l l o c a t a b l e R e s o u r c e s   c a l l


Question: What is GetAllocatableResources gRPC endpoint?

Answer: G e t A l l o c a t a b l e R e s o u r c e s   p r o v i d e s   i n f o r m a t i o n   o n   r e s o u r c e s   i n i t i a l l y   a v a i l a b l e   o n   t h e   w o r k e r   n o d e .   I t   p r o v i d e s   m o r e   i n f o r m a t i o n   t h a n   k u b e l e t   e x p o r t s   t o   A P I S e r v e r .


Question: What is Note:?

Answer: G e t A l l o c a t a b l e R e s o u r c e s   s h o u l d   o n l y   b e   u s e d   t o   e v a l u a t e   a l l o c a t a b l e   r e s o u r c e s   o n   a   n o d e .   I f   t h e   g o a l   i s   t o   e v a l u a t e   f r e e / u n a l l o c a t e d   r e s o u r c e s   i t   s h o u l d   b e   u s e d   i n   c o n j u n c t i o n   w i t h   t h e   L i s t ( )   e n d p o i n t .   T h e   r e s u l t   o b t a i n e d   b y   G e t A l l o c a t a b l e R e s o u r c e s   w o u l d   r e m a i n   t h e   s a m e   u n l e s s   t h e   u n d e r l y i n g   r e s o u r c e s   e x p o s e d   t o   k u b e l e t   c h a n g e .   T h i s   h a p p e n s   r a r e l y   b u t   w h e n   i t   d o e s   ( f o r   e x a m p l e :   h o t p l u g / h o t u n p l u g ,   d e v i c e   h e a l t h   c h a n g e s ) ,   c l i e n t   i s   e x p e c t e d   t o   c a l l   G e t A l l o c t a b l e R e s o u r c e s   e n d p o i n t .   H o w e v e r ,   c a l l i n g   G e t A l l o c a t a b l e R e s o u r c e s   e n d p o i n t   i s   n o t   s u f f i c i e n t   i n   c a s e   o f   c p u   a n d / o r   m e m o r y   u p d a t e   a n d   K u b e l e t   n e e d s   t o   b e   r e s t a r t e d   t o   r e f l e c t   t h e   c o r r e c t   r e s o u r c e   c a p a c i t y   a n d   a l l o c a t a b l e .   / /   A l l o c a t a b l e R e s o u r c e s R e s p o n s e s   c o n t a i n s   i n f o r m a t i o n   a b o u t   a l l   t h e   d e v i c e s   k n o w n   b y   t h e   k u b e l e t   m e s s a g e   A l l o c a t a b l e R e s o u r c e s R e s p o n s e   {   r e p e a t e d   C o n t a i n e r D e v i c e s   d e v i c e s   =   1 ;   r e p e a t e d   i n t 6 4   c p u _ i d s   =   2 ;   r e p e a t e d   C o n t a i n e r M e m o r y   m e m o r y   =   3 ;   }   C o n t a i n e r D e v i c e s   d o   e x p o s e   t h e   t o p o l o g y   i n f o r m a t i o n   d e c l a r i n g   t o   w h i c h   N U M A   c e


Question: What is Note:?

Answer: W h e n   a c c e s s i n g   t h e   / v a r / l i b / k u b e l e t / p o d - r e s o u r c e s / k u b e l e t . s o c k   f r o m   D a e m o n S e t   o r   a n y   o t h e r   a p p   d e p l o y e d   a s   a   c o n t a i n e r   o n   t h e   h o s t ,   w h i c h   i s   m o u n t i n g   s o c k e t   a s   a   v o l u m e ,   i t   i s   a   g o o d   p r a c t i c e   t o   m o u n t   d i r e c t o r y   / v a r / l i b / k u b e l e t / p o d - r e s o u r c e s /   i n s t e a d   o f   t h e   / v a r / l i b / k u b e l e t / p o d - r e s o u r c e s / k u b e l e t . s o c k .   T h i s   w i l l   e n s u r e   t h a t   a f t e r   k u b e l e t   r e s t a r t ,   c o n t a i n e r   w i l l   b e   a b l e   t o   r e - c o n n e c t   t o   t h i s   s o c k e t .   C o n t a i n e r   m o u n t s   a r e   m a n a g e d   b y   i n o d e   r e f e r e n c i n g   t h e   s o c k e t   o r   d i r e c t o r y ,   d e p e n d i n g   o n   w h a t   w a s   m o u n t e d .   W h e n   k u b e l e t   r e s t a r t s ,   s o c k e t   i s   d e l e t e d   a n d   a   n e w   s o c k e t   i s   c r e a t e d ,   w h i l e   d i r e c t o r y   s t a y s   u n t o u c h e d .   S o   t h e   o r i g i n a l   i n o d e   f o r   t h e   s o c k e t   b e c o m e   u n u s a b l e .   I n o d e   t o   d i r e c t o r y   w i l l   c o n t i n u e   w o r k i n g .