Question: What is Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller?

Answer: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission ControllerThis page describes the process of migrating from PodSecurityPolicies to the built-in PodSecurity admission controller. This can be done effectively using a combination of dry-run and audit and warn modes, although this becomes harder if mutating PSPs are used.Before you beginYour Kubernetes server must be at or later than version v1.22.To check the version, enter kubectl version.If you are currently running a version of Kubernetes other than 1.34, you may want to switch to viewing this page in the documentation for the version of Kubernetes that you are actually running.This page assumes you are already familiar with the basic Pod Security Admission concepts.Overall approachThere are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security Admission. The following steps are one possible migration path, with a goal of minimizing both the risks of a production outage and of a security gap.Decide whether Pod Security Admission is the right fit for your use case.Review namespace permissionsSimplify & standardize PodSecurityPoliciesUpdate namespacesIdentify an appropriate Pod Security levelVerify the Pod Security levelEnforce the Pod Security levelBypass PodSecurityPolicyReview namespace creation processesDisable PodSecurityPolicy0. Decide whether Pod Security Admission is right for youPod Security Admission was designed to meet the most common security needs out of the box, and to provide a standard set of security levels across clusters. However, it is less flexible than PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod Security Admission:Setting default security constraints - Pod Security Admission is a non-mutating admission controller, meaning it won't modify pods before validating them. If you were relying on this aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, or use a Mutating Admission Webhook to make those changes. See Simplify & Standardize PodSecurityPolicies below for more detail.Fine-grained control over policy definition - Pod Security Admission only supports 3 standard levels. If you require more control over specific constraints, then you will need to use a Validating Admission Webhook to enforce those policies.Sub-namespace policy granularity - PodSecurityPolicy lets you bind different policies to different Service Accounts or users, even within a single namespace. This approach has many pitfalls and is not recommended, but if you require this feature anyway you will need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt specific users or RuntimeClasses, in which case Pod Security Admission does expose some static configuration for exemptions.Even if Pod Security Admission does not meet all of your needs it was designed to be complementary to other policy enforcement mechanisms, an


Question: How does Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller work?

Answer: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission ControllerThis page describes the process of migrating from PodSecurityPolicies to the built-in PodSecurity admission controller. This can be done effectively using a combination of dry-run and audit and warn modes, although this becomes harder if mutating PSPs are used.Before you beginYour Kubernetes server must be at or later than version v1.22.To check the version, enter kubectl version.If you are currently running a version of Kubernetes other than 1.34, you may want to switch to viewing this page in the documentation for the version of Kubernetes that you are actually running.This page assumes you are already familiar with the basic Pod Security Admission concepts.Overall approachThere are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security Admission. The following steps are one possible migration path, with a goal of minimizing both the risks of a production outage and of a security gap.Decide whether Pod Security Admission is the right fit for your use case.Review namespace permissionsSimplify & standardize PodSecurityPoliciesUpdate namespacesIdentify an appropriate Pod Security levelVerify the Pod Security levelEnforce the Pod Security levelBypass PodSecurityPolicyReview namespace creation processesDisable PodSecurityPolicy0. Decide whether Pod Security Admission is right for youPod Security Admission was designed to meet the most common security needs out of the box, and to provide a standard set of security levels across clusters. However, it is less flexible than PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod Security Admission:Setting default security constraints - Pod Security Admission is a non-mutating admission controller, meaning it won't modify pods before validating them. If you were relying on this aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, or use a Mutating Admission Webhook to make those changes. See Simplify & Standardize PodSecurityPolicies below for more detail.Fine-grained control over policy definition - Pod Security Admission only supports 3 standard levels. If you require more control over specific constraints, then you will need to use a Validating Admission Webhook to enforce those policies.Sub-namespace policy granularity - PodSecurityPolicy lets you bind different policies to different Service Accounts or users, even within a single namespace. This approach has many pitfalls and is not recommended, but if you require this feature anyway you will need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt specific users or RuntimeClasses, in which case Pod Security Admission does expose some static configuration for exemptions.Even if Pod Security Admission does not meet all of your needs it was designed to be complementary to other policy enforcement mechanisms, an


Question: When would you use Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller?

Answer: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission ControllerThis page describes the process of migrating from PodSecurityPolicies to the built-in PodSecurity admission controller. This can be done effectively using a combination of dry-run and audit and warn modes, although this becomes harder if mutating PSPs are used.Before you beginYour Kubernetes server must be at or later than version v1.22.To check the version, enter kubectl version.If you are currently running a version of Kubernetes other than 1.34, you may want to switch to viewing this page in the documentation for the version of Kubernetes that you are actually running.This page assumes you are already familiar with the basic Pod Security Admission concepts.Overall approachThere are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security Admission. The following steps are one possible migration path, with a goal of minimizing both the risks of a production outage and of a security gap.Decide whether Pod Security Admission is the right fit for your use case.Review namespace permissionsSimplify & standardize PodSecurityPoliciesUpdate namespacesIdentify an appropriate Pod Security levelVerify the Pod Security levelEnforce the Pod Security levelBypass PodSecurityPolicyReview namespace creation processesDisable PodSecurityPolicy0. Decide whether Pod Security Admission is right for youPod Security Admission was designed to meet the most common security needs out of the box, and to provide a standard set of security levels across clusters. However, it is less flexible than PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod Security Admission:Setting default security constraints - Pod Security Admission is a non-mutating admission controller, meaning it won't modify pods before validating them. If you were relying on this aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, or use a Mutating Admission Webhook to make those changes. See Simplify & Standardize PodSecurityPolicies below for more detail.Fine-grained control over policy definition - Pod Security Admission only supports 3 standard levels. If you require more control over specific constraints, then you will need to use a Validating Admission Webhook to enforce those policies.Sub-namespace policy granularity - PodSecurityPolicy lets you bind different policies to different Service Accounts or users, even within a single namespace. This approach has many pitfalls and is not recommended, but if you require this feature anyway you will need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt specific users or RuntimeClasses, in which case Pod Security Admission does expose some static configuration for exemptions.Even if Pod Security Admission does not meet all of your needs it was designed to be complementary to other policy enforcement mechanisms, an


Question: What are the benefits of Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller?

Answer: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission ControllerThis page describes the process of migrating from PodSecurityPolicies to the built-in PodSecurity admission controller. This can be done effectively using a combination of dry-run and audit and warn modes, although this becomes harder if mutating PSPs are used.Before you beginYour Kubernetes server must be at or later than version v1.22.To check the version, enter kubectl version.If you are currently running a version of Kubernetes other than 1.34, you may want to switch to viewing this page in the documentation for the version of Kubernetes that you are actually running.This page assumes you are already familiar with the basic Pod Security Admission concepts.Overall approachThere are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security Admission. The following steps are one possible migration path, with a goal of minimizing both the risks of a production outage and of a security gap.Decide whether Pod Security Admission is the right fit for your use case.Review namespace permissionsSimplify & standardize PodSecurityPoliciesUpdate namespacesIdentify an appropriate Pod Security levelVerify the Pod Security levelEnforce the Pod Security levelBypass PodSecurityPolicyReview namespace creation processesDisable PodSecurityPolicy0. Decide whether Pod Security Admission is right for youPod Security Admission was designed to meet the most common security needs out of the box, and to provide a standard set of security levels across clusters. However, it is less flexible than PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod Security Admission:Setting default security constraints - Pod Security Admission is a non-mutating admission controller, meaning it won't modify pods before validating them. If you were relying on this aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, or use a Mutating Admission Webhook to make those changes. See Simplify & Standardize PodSecurityPolicies below for more detail.Fine-grained control over policy definition - Pod Security Admission only supports 3 standard levels. If you require more control over specific constraints, then you will need to use a Validating Admission Webhook to enforce those policies.Sub-namespace policy granularity - PodSecurityPolicy lets you bind different policies to different Service Accounts or users, even within a single namespace. This approach has many pitfalls and is not recommended, but if you require this feature anyway you will need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt specific users or RuntimeClasses, in which case Pod Security Admission does expose some static configuration for exemptions.Even if Pod Security Admission does not meet all of your needs it was designed to be complementary to other policy enforcement mechanisms, an


Question: What is Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller?

Answer: T h i s   p a g e   d e s c r i b e s   t h e   p r o c e s s   o f   m i g r a t i n g   f r o m   P o d S e c u r i t y P o l i c i e s   t o   t h e   b u i l t - i n   P o d S e c u r i t y   a d m i s s i o n   c o n t r o l l e r .   T h i s   c a n   b e   d o n e   e f f e c t i v e l y   u s i n g   a   c o m b i n a t i o n   o f   d r y - r u n   a n d   a u d i t   a n d   w a r n   m o d e s ,   a l t h o u g h   t h i s   b e c o m e s   h a r d e r   i f   m u t a t i n g   P S P s   a r e   u s e d .


Question: What is Before you begin?

Answer: Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 2 2 .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   I f   y o u   a r e   c u r r e n t l y   r u n n i n g   a   v e r s i o n   o f   K u b e r n e t e s   o t h e r   t h a n   1 . 3 4 ,   y o u   m a y   w a n t   t o   s w i t c h   t o   v i e w i n g   t h i s   p a g e   i n   t h e   d o c u m e n t a t i o n   f o r   t h e   v e r s i o n   o f   K u b e r n e t e s   t h a t   y o u   a r e   a c t u a l l y   r u n n i n g .   T h i s   p a g e   a s s u m e s   y o u   a r e   a l r e a d y   f a m i l i a r   w i t h   t h e   b a s i c   P o d   S e c u r i t y   A d m i s s i o n   c o n c e p t s .


Question: What is Overall approach?

Answer: T h e r e   a r e   m u l t i p l e   s t r a t e g i e s   y o u   c a n   t a k e   f o r   m i g r a t i n g   f r o m   P o d S e c u r i t y P o l i c y   t o   P o d   S e c u r i t y   A d m i s s i o n .   T h e   f o l l o w i n g   s t e p s   a r e   o n e   p o s s i b l e   m i g r a t i o n   p a t h ,   w i t h   a   g o a l   o f   m i n i m i z i n g   b o t h   t h e   r i s k s   o f   a   p r o d u c t i o n   o u t a g e   a n d   o f   a   s e c u r i t y   g a p .   D e c i d e   w h e t h e r   P o d   S e c u r i t y   A d m i s s i o n   i s   t h e   r i g h t   f i t   f o r   y o u r   u s e   c a s e . R e v i e w   n a m e s p a c e   p e r m i s s i o n s S i m p l i f y   &   s t a n d a r d i z e   P o d S e c u r i t y P o l i c i e s U p d a t e   n a m e s p a c e s I d e n t i f y   a n   a p p r o p r i a t e   P o d   S e c u r i t y   l e v e l V e r i f y   t h e   P o d   S e c u r i t y   l e v e l E n f o r c e   t h e   P o d   S e c u r i t y   l e v e l B y p a s s   P o d S e c u r i t y P o l i c y R e v i e w   n a m e s p a c e   c r e a t i o n   p r o c e s s e s D i s a b l e   P o d S e c u r i t y P o l i c y   I d e n t i f y   a n   a p p r o p r i a t e   P o d   S e c u r i t y   l e v e l V e r i f y   t h e   P o d   S e c u r i t y   l e v e l E n f o r c e   t h e   P o d   S e c u r i t y   l e v e l B y p a s s   P o d S e c u r i t y P o l i c y


Question: What is 0. Decide whether Pod Security Admission is right for you?

Answer: P o d   S e c u r i t y   A d m i s s i o n   w a s   d e s i g n e d   t o   m e e t   t h e   m o s t   c o m m o n   s e c u r i t y   n e e d s   o u t   o f   t h e   b o x ,   a n d   t o   p r o v i d e   a   s t a n d a r d   s e t   o f   s e c u r i t y   l e v e l s   a c r o s s   c l u s t e r s .   H o w e v e r ,   i t   i s   l e s s   f l e x i b l e   t h a n   P o d S e c u r i t y P o l i c y .   N o t a b l y ,   t h e   f o l l o w i n g   f e a t u r e s   a r e   s u p p o r t e d   b y   P o d S e c u r i t y P o l i c y   b u t   n o t   P o d   S e c u r i t y   A d m i s s i o n :   S e t t i n g   d e f a u l t   s e c u r i t y   c o n s t r a i n t s   -   P o d   S e c u r i t y   A d m i s s i o n   i s   a   n o n - m u t a t i n g   a d m i s s i o n   c o n t r o l l e r ,   m e a n i n g   i t   w o n ' t   m o d i f y   p o d s   b e f o r e   v a l i d a t i n g   t h e m .   I f   y o u   w e r e   r e l y i n g   o n   t h i s   a s p e c t   o f   P S P ,   y o u   w i l l   n e e d   t o   e i t h e r   m o d i f y   y o u r   w o r k l o a d s   t o   m e e t   t h e   P o d   S e c u r i t y   c o n s t r a i n t s ,   o r   u s e   a   M u t a t i n g   A d m i s s i o n   W e b h o o k   t o   m a k e   t h o s e   c h a n g e s .   S e e   S i m p l i f y   &   S t a n d a r d i z e   P o d S e c u r i t y P o l i c i e s   b e l o w   f o r   m o r e   d e t a i l . F i n e - g r a i n e d   c o n t r o l   o v e r   p o l i c y   d e f i n i t i o n   -   P o d   S e c u r i t y   A d m i s s i o n   o n l y   s u p p o r t s   3   s t a n d a r d   l e v e l s .   I f   y o u   r e q u i r e   m o r e   c o n t r o l   o v e r   s p e c i f i c   c o n s t r a i n t s ,   t h e n   y o u   w i l l   n e e d   t o   u s e   a   V a l i d a t i n g   A d m i s s i o n   W e b h o o k   t o   e n f o r c e   t h o s e   p o l i c i e s . S u b - n a m e s p a c e   p o l i c y   g r a n u l a r i t y   -   P o d S e c


Question: What is 1. Review namespace permissions?

Answer: P o d   S e c u r i t y   A d m i s s i o n   i s   c o n t r o l l e d   b y   l a b e l s   o n   n a m e s p a c e s .   T h i s   m e a n s   t h a t   a n y o n e   w h o   c a n   u p d a t e   ( o r   p a t c h   o r   c r e a t e )   a   n a m e s p a c e   c a n   a l s o   m o d i f y   t h e   P o d   S e c u r i t y   l e v e l   f o r   t h a t   n a m e s p a c e ,   w h i c h   c o u l d   b e   u s e d   t o   b y p a s s   a   m o r e   r e s t r i c t i v e   p o l i c y .   B e f o r e   p r o c e e d i n g ,   e n s u r e   t h a t   o n l y   t r u s t e d ,   p r i v i l e g e d   u s e r s   h a v e   t h e s e   n a m e s p a c e   p e r m i s s i o n s .   I t   i s   n o t   r e c o m m e n d e d   t o   g r a n t   t h e s e   p o w e r f u l   p e r m i s s i o n s   t o   u s e r s   t h a t   s h o u l d n ' t   h a v e   e l e v a t e d   p e r m i s s i o n s ,   b u t   i f   y o u   m u s t   y o u   w i l l   n e e d   t o   u s e   a n   a d m i s s i o n   w e b h o o k   t o   p l a c e   a d d i t i o n a l   r e s t r i c t i o n s   o n   s e t t i n g   P o d   S e c u r i t y   l a b e l s   o n   N a m e s p a c e   o b j e c t s .


Question: What is 2. Simplify & standardize PodSecurityPolicies?

Answer: I n   t h i s   s e c t i o n ,   y o u   w i l l   r e d u c e   m u t a t i n g   P o d S e c u r i t y P o l i c i e s   a n d   r e m o v e   o p t i o n s   t h a t   a r e   o u t s i d e   t h e   s c o p e   o f   t h e   P o d   S e c u r i t y   S t a n d a r d s .   Y o u   s h o u l d   m a k e   t h e   c h a n g e s   r e c o m m e n d e d   h e r e   t o   a n   o f f l i n e   c o p y   o f   t h e   o r i g i n a l   P o d S e c u r i t y P o l i c y   b e i n g   m o d i f i e d .   T h e   c l o n e d   P S P   s h o u l d   h a v e   a   d i f f e r e n t   n a m e   t h a t   i s   a l p h a b e t i c a l l y   b e f o r e   t h e   o r i g i n a l   ( f o r   e x a m p l e ,   p r e p e n d   a   0   t o   i t ) .   D o   n o t   c r e a t e   t h e   n e w   p o l i c i e s   i n   K u b e r n e t e s   y e t   -   t h a t   w i l l   b e   c o v e r e d   i n   t h e   R o l l o u t   t h e   u p d a t e d   p o l i c i e s   s e c t i o n   b e l o w .


Question: What is 2.a. Eliminate purely mutating fields?

Answer: I f   a   P o d S e c u r i t y P o l i c y   i s   m u t a t i n g   p o d s ,   t h e n   y o u   c o u l d   e n d   u p   w i t h   p o d s   t h a t   d o n ' t   m e e t   t h e   P o d   S e c u r i t y   l e v e l   r e q u i r e m e n t s   w h e n   y o u   f i n a l l y   t u r n   P o d S e c u r i t y P o l i c y   o f f .   I n   o r d e r   t o   a v o i d   t h i s ,   y o u   s h o u l d   e l i m i n a t e   a l l   P S P   m u t a t i o n   p r i o r   t o   s w i t c h i n g   o v e r .   U n f o r t u n a t e l y   P S P   d o e s   n o t   c l e a n l y   s e p a r a t e   m u t a t i n g   &   v a l i d a t i n g   f i e l d s ,   s o   t h i s   i s   n o t   a   s t r a i g h t f o r w a r d   m i g r a t i o n .   Y o u   c a n   s t a r t   b y   e l i m i n a t i n g   t h e   f i e l d s   t h a t   a r e   p u r e l y   m u t a t i n g ,   a n d   d o n ' t   h a v e   a n y   b e a r i n g   o n   t h e   v a l i d a t i n g   p o l i c y .   T h e s e   f i e l d s   ( a l s o   l i s t e d   i n   t h e   M a p p i n g   P o d S e c u r i t y P o l i c i e s   t o   P o d   S e c u r i t y   S t a n d a r d s   r e f e r e n c e )   a r e :   . s p e c . d e f a u l t A l l o w P r i v i l e g e E s c a l a t i o n . s p e c . r u n t i m e C l a s s . d e f a u l t R u n t i m e C l a s s N a m e . m e t a d a t a . a n n o t a t i o n s [ ' s e c c o m p . s e c u r i t y . a l p h a . k u b e r n e t e s . i o / d e f a u l t P r o f i l e N a m e ' ] . m e t a d a t a . a n n o t a t i o n s [ ' a p p a r m o r . s e c u r i t y . b e t a . k u b e r n e t e s . i o / d e f a u l t P r o f i l e N a m e ' ] . s p e c . d e f a u l t A d d C a p a b i l i t i e s   -   A l t h o u g h   t e c h n i c a l l y   a   m u t a t i n g   &   v a l i d a t i n g   f i e l d ,   t h e s e   s h o u l d   b e   m e r g e d   i n t o   . s p e c . a l l o w e d C a p a b i l i t i e s   w h i c h   p e r f o r m s   t h e   s a m e   v a l


Question: What is 2.b. Eliminate options not covered by the Pod Security Standards?

Answer: T h e r e   a r e   s e v e r a l   f i e l d s   i n   P o d S e c u r i t y P o l i c y   t h a t   a r e   n o t   c o v e r e d   b y   t h e   P o d   S e c u r i t y   S t a n d a r d s .   I f   y o u   m u s t   e n f o r c e   t h e s e   o p t i o n s ,   y o u   w i l l   n e e d   t o   s u p p l e m e n t   P o d   S e c u r i t y   A d m i s s i o n   w i t h   a n   a d m i s s i o n   w e b h o o k ,   w h i c h   i s   o u t s i d e   t h e   s c o p e   o f   t h i s   g u i d e .   F i r s t ,   y o u   c a n   r e m o v e   t h e   p u r e l y   v a l i d a t i n g   f i e l d s   t h a t   t h e   P o d   S e c u r i t y   S t a n d a r d s   d o   n o t   c o v e r .   T h e s e   f i e l d s   ( a l s o   l i s t e d   i n   t h e   M a p p i n g   P o d S e c u r i t y P o l i c i e s   t o   P o d   S e c u r i t y   S t a n d a r d s   r e f e r e n c e   w i t h   " n o   o p i n i o n " )   a r e :   . s p e c . a l l o w e d H o s t P a t h s . s p e c . a l l o w e d F l e x V o l u m e s . s p e c . a l l o w e d C S I D r i v e r s . s p e c . f o r b i d d e n S y s c t l s . s p e c . r u n t i m e C l a s s   Y o u   c a n   a l s o   r e m o v e   t h e   f o l l o w i n g   f i e l d s ,   t h a t   a r e   r e l a t e d   t o   P O S I X   /   U N I X   g r o u p   c o n t r o l s .


Question: What is Caution:?

Answer: . s p e c . r u n A s G r o u p . s p e c . s u p p l e m e n t a l G r o u p s . s p e c . f s G r o u p   T h e   r e m a i n i n g   m u t a t i n g   f i e l d s   a r e   r e q u i r e d   t o   p r o p e r l y   s u p p o r t   t h e   P o d   S e c u r i t y   S t a n d a r d s ,   a n d   w i l l   n e e d   t o   b e   h a n d l e d   o n   a   c a s e - b y - c a s e   b a s i s   l a t e r :   . s p e c . r e q u i r e d D r o p C a p a b i l i t i e s   -   R e q u i r e d   t o   d r o p   A L L   f o r   t h e   R e s t r i c t e d   p r o f i l e . . s p e c . s e L i n u x   -   ( O n l y   m u t a t i n g   w i t h   t h e   M u s t R u n A s   r u l e )   r e q u i r e d   t o   e n f o r c e   t h e   S E L i n u x   r e q u i r e m e n t s   o f   t h e   B a s e l i n e   &   R e s t r i c t e d   p r o f i l e s . . s p e c . r u n A s U s e r   -   ( N o n - m u t a t i n g   w i t h   t h e   R u n A s A n y   r u l e )   r e q u i r e d   t o   e n f o r c e   R u n A s N o n R o o t   f o r   t h e   R e s t r i c t e d   p r o f i l e . . s p e c . a l l o w P r i v i l e g e E s c a l a t i o n   -   ( O n l y   m u t a t i n g   i f   s e t   t o   f a l s e )   r e q u i r e d   f o r   t h e   R e s t r i c t e d   p r o f i l e .


Question: What is 2.c. Rollout the updated PSPs?

Answer: N e x t ,   y o u   c a n   r o l l o u t   t h e   u p d a t e d   p o l i c i e s   t o   y o u r   c l u s t e r .   Y o u   s h o u l d   p r o c e e d   w i t h   c a u t i o n ,   a s   r e m o v i n g   t h e   m u t a t i n g   o p t i o n s   m a y   r e s u l t   i n   w o r k l o a d s   m i s s i n g   r e q u i r e d   c o n f i g u r a t i o n .   F o r   e a c h   u p d a t e d   P o d S e c u r i t y P o l i c y :   I d e n t i f y   p o d s   r u n n i n g   u n d e r   t h e   o r i g i n a l   P S P .   T h i s   c a n   b e   d o n e   u s i n g   t h e   k u b e r n e t e s . i o / p s p   a n n o t a t i o n .   F o r   e x a m p l e ,   u s i n g   k u b e c t l : P S P _ N A M E = " o r i g i n a l "   #   S e t   t h e   n a m e   o f   t h e   P S P   y o u ' r e   c h e c k i n g   f o r   k u b e c t l   g e t   p o d s   - - a l l - n a m e s p a c e s   - o   j s o n p a t h = " { r a n g e   . i t e m s [ ? ( @ . m e t a d a t a . a n n o t a t i o n s . k u b e r n e t e s \ . i o \ / p s p = = ' $ P S P _ N A M E ' ) ] } { . m e t a d a t a . n a m e s p a c e }   { . m e t a d a t a . n a m e } { ' \ n ' } { e n d } "   C o m p a r e   t h e s e   r u n n i n g   p o d s   a g a i n s t   t h e   o r i g i n a l   p o d   s p e c   t o   d e t e r m i n e   w h e t h e r   P o d S e c u r i t y P o l i c y   h a s   m o d i f i e d   t h e   p o d .   F o r   p o d s   c r e a t e d   b y   a   w o r k l o a d   r e s o u r c e   y o u   c a n   c o m p a r e   t h e   p o d   w i t h   t h e   P o d T e m p l a t e   i n   t h e   c o n t r o l l e r   r e s o u r c e .   I f   a n y   c h a n g e s   a r e   i d e n t i f i e d ,   t h e   o r i g i n a l   P o d   o r   P o d T e m p l a t e   s h o u l d   b e   u p d a t e d   w i t h   t h e   d e s i r e d   c o n f i g u r a t i o n .   T h e   f i e l d s   t o   r e v i e w   a r e : . m e t a d a t a . a n n o t a t i o n s [ ' c o n t a i n e r . a p p a r m o r . s e c


Question: What is 3. Update Namespaces?

Answer: T h e   f o l l o w i n g   s t e p s   w i l l   n e e d   t o   b e   p e r f o r m e d   o n   e v e r y   n a m e s p a c e   i n   t h e   c l u s t e r .   C o m m a n d s   r e f e r e n c e d   i n   t h e s e   s t e p s   u s e   t h e   $ N A M E S P A C E   v a r i a b l e   t o   r e f e r   t o   t h e   n a m e s p a c e   b e i n g   u p d a t e d .


Question: What is 3.a. Identify an appropriate Pod Security level?

Answer: S t a r t   r e v i e w i n g   t h e   P o d   S e c u r i t y   S t a n d a r d s   a n d   f a m i l i a r i z i n g   y o u r s e l f   w i t h   t h e   3   d i f f e r e n t   l e v e l s .   T h e r e   a r e   s e v e r a l   w a y s   t o   c h o o s e   a   P o d   S e c u r i t y   l e v e l   f o r   y o u r   n a m e s p a c e :   B y   s e c u r i t y   r e q u i r e m e n t s   f o r   t h e   n a m e s p a c e   -   I f   y o u   a r e   f a m i l i a r   w i t h   t h e   e x p e c t e d   a c c e s s   l e v e l   f o r   t h e   n a m e s p a c e ,   y o u   c a n   c h o o s e   a n   a p p r o p r i a t e   l e v e l   b a s e d   o n   t h o s e   r e q u i r e m e n t s ,   s i m i l a r   t o   h o w   o n e   m i g h t   a p p r o a c h   t h i s   o n   a   n e w   c l u s t e r . B y   e x i s t i n g   P o d S e c u r i t y P o l i c i e s   -   U s i n g   t h e   M a p p i n g   P o d S e c u r i t y P o l i c i e s   t o   P o d   S e c u r i t y   S t a n d a r d s   r e f e r e n c e   y o u   c a n   m a p   e a c h   P S P   t o   a   P o d   S e c u r i t y   S t a n d a r d   l e v e l .   I f   y o u r   P S P s   a r e n ' t   b a s e d   o n   t h e   P o d   S e c u r i t y   S t a n d a r d s ,   y o u   m a y   n e e d   t o   d e c i d e   b e t w e e n   c h o o s i n g   a   l e v e l   t h a t   i s   a t   l e a s t   a s   p e r m i s s i v e   a s   t h e   P S P ,   a n d   a   l e v e l   t h a t   i s   a t   l e a s t   a s   r e s t r i c t i v e .   Y o u   c a n   s e e   w h i c h   P S P s   a r e   i n   u s e   f o r   p o d s   i n   a   g i v e n   n a m e s p a c e   w i t h   t h i s   c o m m a n d : k u b e c t l   g e t   p o d s   - n   $ N A M E S P A C E   - o   j s o n p a t h = " { . i t e m s [ * ] . m e t a d a t a . a n n o t a t i o n s . k u b e r n e t e s \ . i o \ / p s p } "   |   t r   "   "   " \ n "   |   s o r t   - u   B y   e x i s t i n g   p o d s   -   U s i n g   t h e   s t


Question: What is 3.b. Verify the Pod Security level?

Answer: O n c e   y o u   h a v e   s e l e c t e d   a   P o d   S e c u r i t y   l e v e l   f o r   t h e   n a m e s p a c e   ( o r   i f   y o u ' r e   t r y i n g   s e v e r a l ) ,   i t ' s   a   g o o d   i d e a   t o   t e s t   i t   o u t   f i r s t   ( y o u   c a n   s k i p   t h i s   s t e p   i f   u s i n g   t h e   P r i v i l e g e d   l e v e l ) .   P o d   S e c u r i t y   i n c l u d e s   s e v e r a l   t o o l s   t o   h e l p   t e s t   a n d   s a f e l y   r o l l   o u t   p r o f i l e s .   F i r s t ,   y o u   c a n   d r y - r u n   t h e   p o l i c y ,   w h i c h   w i l l   e v a l u a t e   p o d s   c u r r e n t l y   r u n n i n g   i n   t h e   n a m e s p a c e   a g a i n s t   t h e   a p p l i e d   p o l i c y ,   w i t h o u t   m a k i n g   t h e   n e w   p o l i c y   t a k e   e f f e c t :   #   $ L E V E L   i s   t h e   l e v e l   t o   d r y - r u n ,   e i t h e r   " b a s e l i n e "   o r   " r e s t r i c t e d " .   k u b e c t l   l a b e l   - - d r y - r u n = s e r v e r   - - o v e r w r i t e   n s   $ N A M E S P A C E   p o d - s e c u r i t y . k u b e r n e t e s . i o / e n f o r c e = $ L E V E L   T h i s   c o m m a n d   w i l l   r e t u r n   a   w a r n i n g   f o r   a n y   e x i s t i n g   p o d s   t h a t   a r e   n o t   v a l i d   u n d e r   t h e   p r o p o s e d   l e v e l .   T h e   s e c o n d   o p t i o n   i s   b e t t e r   f o r   c a t c h i n g   w o r k l o a d s   t h a t   a r e   n o t   c u r r e n t l y   r u n n i n g :   a u d i t   m o d e .   W h e n   r u n n i n g   u n d e r   a u d i t - m o d e   ( a s   o p p o s e d   t o   e n f o r c i n g ) ,   p o d s   t h a t   v i o l a t e   t h e   p o l i c y   l e v e l   a r e   r e c o r d e d   i n   t h e   a u d i t   l o g s ,   w h i c h   c a n   b e   r e v i e w e d   l a t e r   a f t e r   s o m e   s o a k   t i m e ,   b u t   a r e   n o t   f o r b i d d e n .   W a r n i n


Question: What is 3.c. Enforce the Pod Security level?

Answer: W h e n   y o u   a r e   s a t i s f i e d   t h a t   t h e   c h o s e n   l e v e l   c a n   s a f e l y   b e   e n f o r c e d   o n   t h e   n a m e s p a c e ,   y o u   c a n   u p d a t e   t h e   n a m e s p a c e   t o   e n f o r c e   t h e   d e s i r e d   l e v e l :   k u b e c t l   l a b e l   - - o v e r w r i t e   n s   $ N A M E S P A C E   p o d - s e c u r i t y . k u b e r n e t e s . i o / e n f o r c e = $ L E V E L


Question: What is 3.d. Bypass PodSecurityPolicy?

Answer: F i n a l l y ,   y o u   c a n   e f f e c t i v e l y   b y p a s s   P o d S e c u r i t y P o l i c y   a t   t h e   n a m e s p a c e   l e v e l   b y   b i n d i n g   t h e   f u l l y   p r i v i l e g e d   P S P   t o   a l l   s e r v i c e   a c c o u n t s   i n   t h e   n a m e s p a c e .   #   T h e   f o l l o w i n g   c l u s t e r - s c o p e d   c o m m a n d s   a r e   o n l y   n e e d e d   o n c e .   k u b e c t l   a p p l y   - f   p r i v i l e g e d - p s p . y a m l   k u b e c t l   c r e a t e   c l u s t e r r o l e   p r i v i l e g e d - p s p   - - v e r b   u s e   - - r e s o u r c e   p o d s e c u r i t y p o l i c i e s . p o l i c y   - - r e s o u r c e - n a m e   p r i v i l e g e d   #   P e r - n a m e s p a c e   d i s a b l e   k u b e c t l   c r e a t e   - n   $ N A M E S P A C E   r o l e b i n d i n g   d i s a b l e - p s p   - - c l u s t e r r o l e   p r i v i l e g e d - p s p   - - g r o u p   s y s t e m : s e r v i c e a c c o u n t s : $ N A M E S P A C E   S i n c e   t h e   p r i v i l e g e d   P S P   i s   n o n - m u t a t i n g ,   a n d   t h e   P S P   a d m i s s i o n   c o n t r o l l e r   a l w a y s   p r e f e r s   n o n - m u t a t i n g   P S P s ,   t h i s   w i l l   e n s u r e   t h a t   p o d s   i n   t h i s   n a m e s p a c e   a r e   n o   l o n g e r   b e i n g   m o d i f i e d   o r   r e s t r i c t e d   b y   P o d S e c u r i t y P o l i c y .   T h e   a d v a n t a g e   t o   d i s a b l i n g   P o d S e c u r i t y P o l i c y   o n   a   p e r - n a m e s p a c e   b a s i s   l i k e   t h i s   i s   i f   a   p r o b l e m   a r i s e s   y o u   c a n   e a s i l y   r o l l   t h e   c h a n g e   b a c k   b y   d e l e t i n g   t h e   R o l e B i n d i n g .   J u s t   m a k e   s u r e   t h e   p r e - e x i s t i n g   P o d S e c u r i t y P o l i c i e s   a r e   s t i l l   i n   p l a c e !   #   U n d o   P o d S e c u r i t y P o l


Question: What is 4. Review namespace creation processes?

Answer: N o w   t h a t   e x i s t i n g   n a m e s p a c e s   h a v e   b e e n   u p d a t e d   t o   e n f o r c e   P o d   S e c u r i t y   A d m i s s i o n ,   y o u   s h o u l d   e n s u r e   t h a t   y o u r   p r o c e s s e s   a n d / o r   p o l i c i e s   f o r   c r e a t i n g   n e w   n a m e s p a c e s   a r e   u p d a t e d   t o   e n s u r e   t h a t   a n   a p p r o p r i a t e   P o d   S e c u r i t y   p r o f i l e   i s   a p p l i e d   t o   n e w   n a m e s p a c e s .   Y o u   c a n   a l s o   s t a t i c a l l y   c o n f i g u r e   t h e   P o d   S e c u r i t y   a d m i s s i o n   c o n t r o l l e r   t o   s e t   a   d e f a u l t   e n f o r c e ,   a u d i t ,   a n d / o r   w a r n   l e v e l   f o r   u n l a b e l e d   n a m e s p a c e s .   S e e   C o n f i g u r e   t h e   A d m i s s i o n   C o n t r o l l e r   f o r   m o r e   i n f o r m a t i o n .


Question: What is 5. Disable PodSecurityPolicy?

Answer: F i n a l l y ,   y o u ' r e   r e a d y   t o   d i s a b l e   P o d S e c u r i t y P o l i c y .   T o   d o   s o ,   y o u   w i l l   n e e d   t o   m o d i f y   t h e   a d m i s s i o n   c o n f i g u r a t i o n   o f   t h e   A P I   s e r v e r :   H o w   d o   I   t u r n   o f f   a n   a d m i s s i o n   c o n t r o l l e r ? .   T o   v e r i f y   t h a t   t h e   P o d S e c u r i t y P o l i c y   a d m i s s i o n   c o n t r o l l e r   i s   n o   l o n g e r   e n a b l e d ,   y o u   c a n   m a n u a l l y   r u n   a   t e s t   b y   i m p e r s o n a t i n g   a   u s e r   w i t h o u t   a c c e s s   t o   a n y   P o d S e c u r i t y P o l i c i e s   ( s e e   t h e   P o d S e c u r i t y P o l i c y   e x a m p l e ) ,   o r   b y   v e r i f y i n g   i n   t h e   A P I   s e r v e r   l o g s .   A t   s t a r t u p ,   t h e   A P I   s e r v e r   o u t p u t s   l o g   l i n e s   l i s t i n g   t h e   l o a d e d   a d m i s s i o n   c o n t r o l l e r   p l u g i n s :   I 0 2 1 8   0 0 : 5 9 : 4 4 . 9 0 3 3 2 9   1 3   p l u g i n s . g o : 1 5 8 ]   L o a d e d   1 6   m u t a t i n g   a d m i s s i o n   c o n t r o l l e r ( s )   s u c c e s s f u l l y   i n   t h e   f o l l o w i n g   o r d e r :   N a m e s p a c e L i f e c y c l e , L i m i t R a n g e r , S e r v i c e A c c o u n t , N o d e R e s t r i c t i o n , T a i n t N o d e s B y C o n d i t i o n , P r i o r i t y , D e f a u l t T o l e r a t i o n S e c o n d s , E x t e n d e d R e s o u r c e T o l e r a t i o n , P e r s i s t e n t V o l u m e L a b e l , D e f a u l t S t o r a g e C l a s s , S t o r a g e O b j e c t I n U s e P r o t e c t i o n , R u n t i m e C l a s s , D e f a u l t I n g r e s s C l a s s , M u t a t i n g A d m i s s i o n W e b h o o k .   I 0 2 1 8   0 0 : 5 9 : 4 4 . 9 0 3 3 5 0   1 3   p l u g i n s . g o : 1 6 1 ]   L o a d e d   1 4   v a l i d a t i n g   a d m i s s i o n   c o n t r o l l e r


Question: What is Cluster Resources?

Answer: Cluster ResourcesAPIServiceAPIService represents a server for a particular GroupVersion.ComponentStatusComponentStatus (and ComponentStatusList) holds the cluster validation info.EventEvent is a report of an event somewhere in the cluster.IPAddressIPAddress represents a single IP of a single IP Family.LeaseLease defines a lease concept.LeaseCandidate v1beta1LeaseCandidate defines a candidate for a Lease object.NamespaceNamespace provides a scope for Names.NodeNode is a worker node in Kubernetes.RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.ServiceCIDRServiceCIDR defines a range of IP addresses using CIDR format (e.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does Cluster Resources work?

Answer: Cluster ResourcesAPIServiceAPIService represents a server for a particular GroupVersion.ComponentStatusComponentStatus (and ComponentStatusList) holds the cluster validation info.EventEvent is a report of an event somewhere in the cluster.IPAddressIPAddress represents a single IP of a single IP Family.LeaseLease defines a lease concept.LeaseCandidate v1beta1LeaseCandidate defines a candidate for a Lease object.NamespaceNamespace provides a scope for Names.NodeNode is a worker node in Kubernetes.RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.ServiceCIDRServiceCIDR defines a range of IP addresses using CIDR format (e.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use Cluster Resources?

Answer: Cluster ResourcesAPIServiceAPIService represents a server for a particular GroupVersion.ComponentStatusComponentStatus (and ComponentStatusList) holds the cluster validation info.EventEvent is a report of an event somewhere in the cluster.IPAddressIPAddress represents a single IP of a single IP Family.LeaseLease defines a lease concept.LeaseCandidate v1beta1LeaseCandidate defines a candidate for a Lease object.NamespaceNamespace provides a scope for Names.NodeNode is a worker node in Kubernetes.RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.ServiceCIDRServiceCIDR defines a range of IP addresses using CIDR format (e.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of Cluster Resources?

Answer: Cluster ResourcesAPIServiceAPIService represents a server for a particular GroupVersion.ComponentStatusComponentStatus (and ComponentStatusList) holds the cluster validation info.EventEvent is a report of an event somewhere in the cluster.IPAddressIPAddress represents a single IP of a single IP Family.LeaseLease defines a lease concept.LeaseCandidate v1beta1LeaseCandidate defines a candidate for a Lease object.NamespaceNamespace provides a scope for Names.NodeNode is a worker node in Kubernetes.RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.ServiceCIDRServiceCIDR defines a range of IP addresses using CIDR format (e.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is APIService?

Answer: A P I S e r v i c e   r e p r e s e n t s   a   s e r v e r   f o r   a   p a r t i c u l a r   G r o u p V e r s i o n .


Question: What is ComponentStatus?

Answer: C o m p o n e n t S t a t u s   ( a n d   C o m p o n e n t S t a t u s L i s t )   h o l d s   t h e   c l u s t e r   v a l i d a t i o n   i n f o .


Question: What is Event?

Answer: E v e n t   i s   a   r e p o r t   o f   a n   e v e n t   s o m e w h e r e   i n   t h e   c l u s t e r .


Question: What is IPAddress?

Answer: I P A d d r e s s   r e p r e s e n t s   a   s i n g l e   I P   o f   a   s i n g l e   I P   F a m i l y .


Question: What is Lease?

Answer: L e a s e   d e f i n e s   a   l e a s e   c o n c e p t .


Question: What is LeaseCandidate v1beta1?

Answer: L e a s e C a n d i d a t e   d e f i n e s   a   c a n d i d a t e   f o r   a   L e a s e   o b j e c t .


Question: What is Namespace?

Answer: N a m e s p a c e   p r o v i d e s   a   s c o p e   f o r   N a m e s .


Question: What is Node?

Answer: N o d e   i s   a   w o r k e r   n o d e   i n   K u b e r n e t e s .


Question: What is RuntimeClass?

Answer: R u n t i m e C l a s s   d e f i n e s   a   c l a s s   o f   c o n t a i n e r   r u n t i m e   s u p p o r t e d   i n   t h e   c l u s t e r .


Question: What is ServiceCIDR?

Answer: S e r v i c e C I D R   d e f i n e s   a   r a n g e   o f   I P   a d d r e s s e s   u s i n g   C I D R   f o r m a t   ( e .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is kubectl diff?

Answer: kubectl diffSynopsisDiff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.The output is always YAML.KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.kubectl diff -f FILENAME Examples # Diff resources included in pod.json kubectl diff -f pod.json # Diff file read from stdin cat service.yaml | kubectl diff -f - Options--concurrency int Default: 1Number of objects to process in parallel when diffing against the live version. Larger number = faster, but more memory, I/O and CPU over that shorter period of time.--field-manager string Default: "kubectl-client-side-apply"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files contains the configuration to diff--force-conflictsIf true, server-side apply will force the changes against conflicts.-h, --helphelp for diff-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--pruneInclude resources that would be deleted by pruning. Can be used with -l and default shows all resources would be pruned--prune-allowlist stringsOverwrite the default allowlist with <group/version/kind> for --prune-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--server-sideIf true, apply runs in the server instead of the client.--show-managed-fieldsIf true, include managed fields in the diff.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure


Question: How does kubectl diff work?

Answer: kubectl diffSynopsisDiff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.The output is always YAML.KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.kubectl diff -f FILENAME Examples # Diff resources included in pod.json kubectl diff -f pod.json # Diff file read from stdin cat service.yaml | kubectl diff -f - Options--concurrency int Default: 1Number of objects to process in parallel when diffing against the live version. Larger number = faster, but more memory, I/O and CPU over that shorter period of time.--field-manager string Default: "kubectl-client-side-apply"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files contains the configuration to diff--force-conflictsIf true, server-side apply will force the changes against conflicts.-h, --helphelp for diff-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--pruneInclude resources that would be deleted by pruning. Can be used with -l and default shows all resources would be pruned--prune-allowlist stringsOverwrite the default allowlist with <group/version/kind> for --prune-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--server-sideIf true, apply runs in the server instead of the client.--show-managed-fieldsIf true, include managed fields in the diff.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure


Question: When would you use kubectl diff?

Answer: kubectl diffSynopsisDiff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.The output is always YAML.KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.kubectl diff -f FILENAME Examples # Diff resources included in pod.json kubectl diff -f pod.json # Diff file read from stdin cat service.yaml | kubectl diff -f - Options--concurrency int Default: 1Number of objects to process in parallel when diffing against the live version. Larger number = faster, but more memory, I/O and CPU over that shorter period of time.--field-manager string Default: "kubectl-client-side-apply"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files contains the configuration to diff--force-conflictsIf true, server-side apply will force the changes against conflicts.-h, --helphelp for diff-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--pruneInclude resources that would be deleted by pruning. Can be used with -l and default shows all resources would be pruned--prune-allowlist stringsOverwrite the default allowlist with <group/version/kind> for --prune-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--server-sideIf true, apply runs in the server instead of the client.--show-managed-fieldsIf true, include managed fields in the diff.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure


Question: What are the benefits of kubectl diff?

Answer: kubectl diffSynopsisDiff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.The output is always YAML.KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.kubectl diff -f FILENAME Examples # Diff resources included in pod.json kubectl diff -f pod.json # Diff file read from stdin cat service.yaml | kubectl diff -f - Options--concurrency int Default: 1Number of objects to process in parallel when diffing against the live version. Larger number = faster, but more memory, I/O and CPU over that shorter period of time.--field-manager string Default: "kubectl-client-side-apply"Name of the manager used to track field ownership.-f, --filename stringsFilename, directory, or URL to files contains the configuration to diff--force-conflictsIf true, server-side apply will force the changes against conflicts.-h, --helphelp for diff-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.--pruneInclude resources that would be deleted by pruning. Can be used with -l and default shows all resources would be pruned--prune-allowlist stringsOverwrite the default allowlist with <group/version/kind> for --prune-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--server-sideIf true, apply runs in the server instead of the client.--show-managed-fieldsIf true, include managed fields in the diff.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure


Question: What is Synopsis?

Answer: D i f f   c o n f i g u r a t i o n s   s p e c i f i e d   b y   f i l e   n a m e   o r   s t d i n   b e t w e e n   t h e   c u r r e n t   o n l i n e   c o n f i g u r a t i o n ,   a n d   t h e   c o n f i g u r a t i o n   a s   i t   w o u l d   b e   i f   a p p l i e d .   T h e   o u t p u t   i s   a l w a y s   Y A M L .   K U B E C T L _ E X T E R N A L _ D I F F   e n v i r o n m e n t   v a r i a b l e   c a n   b e   u s e d   t o   s e l e c t   y o u r   o w n   d i f f   c o m m a n d .   U s e r s   c a n   u s e   e x t e r n a l   c o m m a n d s   w i t h   p a r a m s   t o o ,   e x a m p l e :   K U B E C T L _ E X T E R N A L _ D I F F = " c o l o r d i f f   - N   - u "   B y   d e f a u l t ,   t h e   " d i f f "   c o m m a n d   a v a i l a b l e   i n   y o u r   p a t h   w i l l   b e   r u n   w i t h   t h e   " - u "   ( u n i f i e d   d i f f )   a n d   " - N "   ( t r e a t   a b s e n t   f i l e s   a s   e m p t y )   o p t i o n s .   E x i t   s t a t u s :   0   N o   d i f f e r e n c e s   w e r e   f o u n d .   1   D i f f e r e n c e s   w e r e   f o u n d .   > 1   K u b e c t l   o r   d i f f   f a i l e d   w i t h   a n   e r r o r .   N o t e :   K U B E C T L _ E X T E R N A L _ D I F F ,   i f   u s e d ,   i s   e x p e c t e d   t o   f o l l o w   t h a t   c o n v e n t i o n .   k u b e c t l   d i f f   - f   F I L E N A M E


Question: What is Examples?

Answer: #   D i f f   r e s o u r c e s   i n c l u d e d   i n   p o d . j s o n   k u b e c t l   d i f f   - f   p o d . j s o n   #   D i f f   f i l e   r e a d   f r o m   s t d i n   c a t   s e r v i c e . y a m l   |   k u b e c t l   d i f f   - f   -


Question: What is Options?

Answer: N u m b e r   o f   o b j e c t s   t o   p r o c e s s   i n   p a r a l l e l   w h e n   d i f f i n g   a g a i n s t   t h e   l i v e   v e r s i o n .   L a r g e r   n u m b e r   =   f a s t e r ,   b u t   m o r e   m e m o r y ,   I / O   a n d   C P U   o v e r   t h a t   s h o r t e r   p e r i o d   o f   t i m e .   N a m e   o f   t h e   m a n a g e r   u s e d   t o   t r a c k   f i e l d   o w n e r s h i p .   F i l e n a m e ,   d i r e c t o r y ,   o r   U R L   t o   f i l e s   c o n t a i n s   t h e   c o n f i g u r a t i o n   t o   d i f f   I f   t r u e ,   s e r v e r - s i d e   a p p l y   w i l l   f o r c e   t h e   c h a n g e s   a g a i n s t   c o n f l i c t s .   h e l p   f o r   d i f f   P r o c e s s   t h e   k u s t o m i z a t i o n   d i r e c t o r y .   T h i s   f l a g   c a n ' t   b e   u s e d   t o g e t h e r   w i t h   - f   o r   - R .   I n c l u d e   r e s o u r c e s   t h a t   w o u l d   b e   d e l e t e d   b y   p r u n i n g .   C a n   b e   u s e d   w i t h   - l   a n d   d e f a u l t   s h o w s   a l l   r e s o u r c e s   w o u l d   b e   p r u n e d   O v e r w r i t e   t h e   d e f a u l t   a l l o w l i s t   w i t h   < g r o u p / v e r s i o n / k i n d >   f o r   - - p r u n e   P r o c e s s   t h e   d i r e c t o r y   u s e d   i n   - f ,   - - f i l e n a m e   r e c u r s i v e l y .   U s e f u l   w h e n   y o u   w a n t   t o   m a n a g e   r e l a t e d   m a n i f e s t s   o r g a n i z e d   w i t h i n   t h e   s a m e   d i r e c t o r y .   S e l e c t o r   ( l a b e l   q u e r y )   t o   f i l t e r   o n ,   s u p p o r t s   ' = ' ,   ' = = ' ,   ' ! = ' ,   ' i n ' ,   ' n o t i n ' . ( e . g .   - l   k e y 1 = v a l u e 1 , k e y 2 = v a l u e 2 , k e y 3   i n   ( v a l u e 3 ) ) .   M a t c h i n g   o b j e c t s   m u s t   s a t i s f y   a l l   o f   t h e   s p e c i f i e d   l a b e l   c o n s t r a i n t s .   I f   t r u e ,


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   -   k u b e c t l   c o n t r o l s   t h e   K u b e r n e t e s   c l u s t e r   m a n a g e r   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Proxies in Kubernetes?

Answer: Proxies in KubernetesThis page explains proxies used with Kubernetes.ProxiesThere are several different proxies you may encounter when using Kubernetes:The kubectl proxy:runs on a user's desktop or in a podproxies from a localhost address to the Kubernetes apiserverclient to proxy uses HTTPproxy to apiserver uses HTTPSlocates apiserveradds authentication headersThe apiserver proxy:is a bastion built into the apiserverconnects a user outside of the cluster to cluster IPs which otherwise might not be reachableruns in the apiserver processesclient to proxy uses HTTPS (or http if apiserver so configured)proxy to target may use HTTP or HTTPS as chosen by proxy using available informationcan be used to reach a Node, Pod, or Servicedoes load balancing when used to reach a ServiceThe kube proxy:runs on each nodeproxies UDP, TCP and SCTPdoes not understand HTTPprovides load balancingis only used to reach servicesA Proxy/Load-balancer in front of apiserver(s):existence and implementation varies from cluster to cluster (e.g. nginx)sits between all clients and one or more apiserversacts as load balancer if there are several apiservers.Cloud Load Balancers on external services:are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)are created automatically when the Kubernetes service has type LoadBalancerusually supports UDP/TCP onlySCTP support is up to the load balancer implementation of the cloud providerimplementation varies by cloud provider.Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin will typically ensure that the latter types are set up correctly.Requesting redirectsProxies have replaced redirect capabilities. Redirects have been deprecated.


Question: How does Proxies in Kubernetes work?

Answer: Proxies in KubernetesThis page explains proxies used with Kubernetes.ProxiesThere are several different proxies you may encounter when using Kubernetes:The kubectl proxy:runs on a user's desktop or in a podproxies from a localhost address to the Kubernetes apiserverclient to proxy uses HTTPproxy to apiserver uses HTTPSlocates apiserveradds authentication headersThe apiserver proxy:is a bastion built into the apiserverconnects a user outside of the cluster to cluster IPs which otherwise might not be reachableruns in the apiserver processesclient to proxy uses HTTPS (or http if apiserver so configured)proxy to target may use HTTP or HTTPS as chosen by proxy using available informationcan be used to reach a Node, Pod, or Servicedoes load balancing when used to reach a ServiceThe kube proxy:runs on each nodeproxies UDP, TCP and SCTPdoes not understand HTTPprovides load balancingis only used to reach servicesA Proxy/Load-balancer in front of apiserver(s):existence and implementation varies from cluster to cluster (e.g. nginx)sits between all clients and one or more apiserversacts as load balancer if there are several apiservers.Cloud Load Balancers on external services:are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)are created automatically when the Kubernetes service has type LoadBalancerusually supports UDP/TCP onlySCTP support is up to the load balancer implementation of the cloud providerimplementation varies by cloud provider.Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin will typically ensure that the latter types are set up correctly.Requesting redirectsProxies have replaced redirect capabilities. Redirects have been deprecated.


Question: When would you use Proxies in Kubernetes?

Answer: Proxies in KubernetesThis page explains proxies used with Kubernetes.ProxiesThere are several different proxies you may encounter when using Kubernetes:The kubectl proxy:runs on a user's desktop or in a podproxies from a localhost address to the Kubernetes apiserverclient to proxy uses HTTPproxy to apiserver uses HTTPSlocates apiserveradds authentication headersThe apiserver proxy:is a bastion built into the apiserverconnects a user outside of the cluster to cluster IPs which otherwise might not be reachableruns in the apiserver processesclient to proxy uses HTTPS (or http if apiserver so configured)proxy to target may use HTTP or HTTPS as chosen by proxy using available informationcan be used to reach a Node, Pod, or Servicedoes load balancing when used to reach a ServiceThe kube proxy:runs on each nodeproxies UDP, TCP and SCTPdoes not understand HTTPprovides load balancingis only used to reach servicesA Proxy/Load-balancer in front of apiserver(s):existence and implementation varies from cluster to cluster (e.g. nginx)sits between all clients and one or more apiserversacts as load balancer if there are several apiservers.Cloud Load Balancers on external services:are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)are created automatically when the Kubernetes service has type LoadBalancerusually supports UDP/TCP onlySCTP support is up to the load balancer implementation of the cloud providerimplementation varies by cloud provider.Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin will typically ensure that the latter types are set up correctly.Requesting redirectsProxies have replaced redirect capabilities. Redirects have been deprecated.


Question: What are the benefits of Proxies in Kubernetes?

Answer: Proxies in KubernetesThis page explains proxies used with Kubernetes.ProxiesThere are several different proxies you may encounter when using Kubernetes:The kubectl proxy:runs on a user's desktop or in a podproxies from a localhost address to the Kubernetes apiserverclient to proxy uses HTTPproxy to apiserver uses HTTPSlocates apiserveradds authentication headersThe apiserver proxy:is a bastion built into the apiserverconnects a user outside of the cluster to cluster IPs which otherwise might not be reachableruns in the apiserver processesclient to proxy uses HTTPS (or http if apiserver so configured)proxy to target may use HTTP or HTTPS as chosen by proxy using available informationcan be used to reach a Node, Pod, or Servicedoes load balancing when used to reach a ServiceThe kube proxy:runs on each nodeproxies UDP, TCP and SCTPdoes not understand HTTPprovides load balancingis only used to reach servicesA Proxy/Load-balancer in front of apiserver(s):existence and implementation varies from cluster to cluster (e.g. nginx)sits between all clients and one or more apiserversacts as load balancer if there are several apiservers.Cloud Load Balancers on external services:are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)are created automatically when the Kubernetes service has type LoadBalancerusually supports UDP/TCP onlySCTP support is up to the load balancer implementation of the cloud providerimplementation varies by cloud provider.Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin will typically ensure that the latter types are set up correctly.Requesting redirectsProxies have replaced redirect capabilities. Redirects have been deprecated.


Question: What is Proxies in Kubernetes?

Answer: T h i s   p a g e   e x p l a i n s   p r o x i e s   u s e d   w i t h   K u b e r n e t e s .


Question: What is Proxies?

Answer: T h e r e   a r e   s e v e r a l   d i f f e r e n t   p r o x i e s   y o u   m a y   e n c o u n t e r   w h e n   u s i n g   K u b e r n e t e s :   T h e   k u b e c t l   p r o x y : r u n s   o n   a   u s e r ' s   d e s k t o p   o r   i n   a   p o d p r o x i e s   f r o m   a   l o c a l h o s t   a d d r e s s   t o   t h e   K u b e r n e t e s   a p i s e r v e r c l i e n t   t o   p r o x y   u s e s   H T T P p r o x y   t o   a p i s e r v e r   u s e s   H T T P S l o c a t e s   a p i s e r v e r a d d s   a u t h e n t i c a t i o n   h e a d e r s T h e   a p i s e r v e r   p r o x y : i s   a   b a s t i o n   b u i l t   i n t o   t h e   a p i s e r v e r c o n n e c t s   a   u s e r   o u t s i d e   o f   t h e   c l u s t e r   t o   c l u s t e r   I P s   w h i c h   o t h e r w i s e   m i g h t   n o t   b e   r e a c h a b l e r u n s   i n   t h e   a p i s e r v e r   p r o c e s s e s c l i e n t   t o   p r o x y   u s e s   H T T P S   ( o r   h t t p   i f   a p i s e r v e r   s o   c o n f i g u r e d ) p r o x y   t o   t a r g e t   m a y   u s e   H T T P   o r   H T T P S   a s   c h o s e n   b y   p r o x y   u s i n g   a v a i l a b l e   i n f o r m a t i o n c a n   b e   u s e d   t o   r e a c h   a   N o d e ,   P o d ,   o r   S e r v i c e d o e s   l o a d   b a l a n c i n g   w h e n   u s e d   t o   r e a c h   a   S e r v i c e T h e   k u b e   p r o x y : r u n s   o n   e a c h   n o d e p r o x i e s   U D P ,   T C P   a n d   S C T P d o e s   n o t   u n d e r s t a n d   H T T P p r o v i d e s   l o a d   b a l a n c i n g i s   o n l y   u s e d   t o   r e a c h   s e r v i c e s A   P r o x y / L o a d - b a l a n c e r   i n   f r o n t   o f   a p i s e r v e r ( s ) : e x i s t e n c e   a n d   i m p l e m e n t a t i o n   v a r i e s   f r o m   c l u s t e r   t o   c l u s t e r   ( e . g .   n g i n x ) s i t s   b e t w e e n   a l l   c l i e n t s   a n d   o n e   o r   m o r


Question: What is Requesting redirects?

Answer: P r o x i e s   h a v e   r e p l a c e d   r e d i r e c t   c a p a b i l i t i e s .   R e d i r e c t s   h a v e   b e e n   d e p r e c a t e d .


Question: What is ResourceFieldSelector?

Answer: ResourceFieldSelectorResourceFieldSelector represents container resources (cpu, memory) and their output format.import "k8s.io/api/core/v1"ResourceFieldSelector represents container resources (cpu, memory) and their output formatresource (string), requiredRequired: resource to selectcontainerName (string)Container name: required for volumes, optional for env varsdivisor (Quantity)Specifies the output format of the exposed resources, defaults to "1"This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does ResourceFieldSelector work?

Answer: ResourceFieldSelectorResourceFieldSelector represents container resources (cpu, memory) and their output format.import "k8s.io/api/core/v1"ResourceFieldSelector represents container resources (cpu, memory) and their output formatresource (string), requiredRequired: resource to selectcontainerName (string)Container name: required for volumes, optional for env varsdivisor (Quantity)Specifies the output format of the exposed resources, defaults to "1"This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use ResourceFieldSelector?

Answer: ResourceFieldSelectorResourceFieldSelector represents container resources (cpu, memory) and their output format.import "k8s.io/api/core/v1"ResourceFieldSelector represents container resources (cpu, memory) and their output formatresource (string), requiredRequired: resource to selectcontainerName (string)Container name: required for volumes, optional for env varsdivisor (Quantity)Specifies the output format of the exposed resources, defaults to "1"This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of ResourceFieldSelector?

Answer: ResourceFieldSelectorResourceFieldSelector represents container resources (cpu, memory) and their output format.import "k8s.io/api/core/v1"ResourceFieldSelector represents container resources (cpu, memory) and their output formatresource (string), requiredRequired: resource to selectcontainerName (string)Container name: required for volumes, optional for env varsdivisor (Quantity)Specifies the output format of the exposed resources, defaults to "1"This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is ResourceFieldSelector?

Answer: i m p o r t   " k 8 s . i o / a p i / c o r e / v 1 "   R e s o u r c e F i e l d S e l e c t o r   r e p r e s e n t s   c o n t a i n e r   r e s o u r c e s   ( c p u ,   m e m o r y )   a n d   t h e i r   o u t p u t   f o r m a t   r e s o u r c e   ( s t r i n g ) ,   r e q u i r e d R e q u i r e d :   r e s o u r c e   t o   s e l e c t c o n t a i n e r N a m e   ( s t r i n g ) C o n t a i n e r   n a m e :   r e q u i r e d   f o r   v o l u m e s ,   o p t i o n a l   f o r   e n v   v a r s d i v i s o r   ( Q u a n t i t y ) S p e c i f i e s   t h e   o u t p u t   f o r m a t   o f   t h e   e x p o s e d   r e s o u r c e s ,   d e f a u l t s   t o   " 1 "   r e s o u r c e   ( s t r i n g ) ,   r e q u i r e d   R e q u i r e d :   r e s o u r c e   t o   s e l e c t   c o n t a i n e r N a m e   ( s t r i n g )   C o n t a i n e r   n a m e :   r e q u i r e d   f o r   v o l u m e s ,   o p t i o n a l   f o r   e n v   v a r s   d i v i s o r   ( Q u a n t i t y )   S p e c i f i e s   t h e   o u t p u t   f o r m a t   o f   t h e   e x p o s e d   r e s o u r c e s ,   d e f a u l t s   t o   " 1 "   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Scheduling, Preemption and Eviction?

Answer: Scheduling, Preemption and EvictionIn Kubernetes, scheduling refers to making sure that Pods are matched to Nodes so that the kubelet can run them. Preemption is the process of terminating Pods with lower Priority so that Pods with higher Priority can schedule on Nodes. Eviction is the process of terminating one or more Pods on Nodes.SchedulingKubernetes SchedulerAssigning Pods to NodesPod OverheadPod Topology Spread ConstraintsTaints and TolerationsScheduling FrameworkDynamic Resource AllocationScheduler Performance TuningResource Bin Packing for Extended ResourcesPod Scheduling ReadinessDeschedulerPod DisruptionPod disruption is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.Pod Priority and PreemptionNode-pressure EvictionAPI-initiated Eviction


Question: How does Scheduling, Preemption and Eviction work?

Answer: Scheduling, Preemption and EvictionIn Kubernetes, scheduling refers to making sure that Pods are matched to Nodes so that the kubelet can run them. Preemption is the process of terminating Pods with lower Priority so that Pods with higher Priority can schedule on Nodes. Eviction is the process of terminating one or more Pods on Nodes.SchedulingKubernetes SchedulerAssigning Pods to NodesPod OverheadPod Topology Spread ConstraintsTaints and TolerationsScheduling FrameworkDynamic Resource AllocationScheduler Performance TuningResource Bin Packing for Extended ResourcesPod Scheduling ReadinessDeschedulerPod DisruptionPod disruption is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.Pod Priority and PreemptionNode-pressure EvictionAPI-initiated Eviction


Question: When would you use Scheduling, Preemption and Eviction?

Answer: Scheduling, Preemption and EvictionIn Kubernetes, scheduling refers to making sure that Pods are matched to Nodes so that the kubelet can run them. Preemption is the process of terminating Pods with lower Priority so that Pods with higher Priority can schedule on Nodes. Eviction is the process of terminating one or more Pods on Nodes.SchedulingKubernetes SchedulerAssigning Pods to NodesPod OverheadPod Topology Spread ConstraintsTaints and TolerationsScheduling FrameworkDynamic Resource AllocationScheduler Performance TuningResource Bin Packing for Extended ResourcesPod Scheduling ReadinessDeschedulerPod DisruptionPod disruption is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.Pod Priority and PreemptionNode-pressure EvictionAPI-initiated Eviction


Question: What are the benefits of Scheduling, Preemption and Eviction?

Answer: Scheduling, Preemption and EvictionIn Kubernetes, scheduling refers to making sure that Pods are matched to Nodes so that the kubelet can run them. Preemption is the process of terminating Pods with lower Priority so that Pods with higher Priority can schedule on Nodes. Eviction is the process of terminating one or more Pods on Nodes.SchedulingKubernetes SchedulerAssigning Pods to NodesPod OverheadPod Topology Spread ConstraintsTaints and TolerationsScheduling FrameworkDynamic Resource AllocationScheduler Performance TuningResource Bin Packing for Extended ResourcesPod Scheduling ReadinessDeschedulerPod DisruptionPod disruption is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.Pod Priority and PreemptionNode-pressure EvictionAPI-initiated Eviction


Question: What is Scheduling, Preemption and Eviction?

Answer: I n   K u b e r n e t e s ,   s c h e d u l i n g   r e f e r s   t o   m a k i n g   s u r e   t h a t   P o d s   a r e   m a t c h e d   t o   N o d e s   s o   t h a t   t h e   k u b e l e t   c a n   r u n   t h e m .   P r e e m p t i o n   i s   t h e   p r o c e s s   o f   t e r m i n a t i n g   P o d s   w i t h   l o w e r   P r i o r i t y   s o   t h a t   P o d s   w i t h   h i g h e r   P r i o r i t y   c a n   s c h e d u l e   o n   N o d e s .   E v i c t i o n   i s   t h e   p r o c e s s   o f   t e r m i n a t i n g   o n e   o r   m o r e   P o d s   o n   N o d e s .


Question: What is Scheduling?

Answer: K u b e r n e t e s   S c h e d u l e r A s s i g n i n g   P o d s   t o   N o d e s P o d   O v e r h e a d P o d   T o p o l o g y   S p r e a d   C o n s t r a i n t s T a i n t s   a n d   T o l e r a t i o n s S c h e d u l i n g   F r a m e w o r k D y n a m i c   R e s o u r c e   A l l o c a t i o n S c h e d u l e r   P e r f o r m a n c e   T u n i n g R e s o u r c e   B i n   P a c k i n g   f o r   E x t e n d e d   R e s o u r c e s P o d   S c h e d u l i n g   R e a d i n e s s D e s c h e d u l e r


Question: What is Pod Disruption?

Answer: P o d   d i s r u p t i o n   i s   t h e   p r o c e s s   b y   w h i c h   P o d s   o n   N o d e s   a r e   t e r m i n a t e d   e i t h e r   v o l u n t a r i l y   o r   i n v o l u n t a r i l y .   V o l u n t a r y   d i s r u p t i o n s   a r e   s t a r t e d   i n t e n t i o n a l l y   b y   a p p l i c a t i o n   o w n e r s   o r   c l u s t e r   a d m i n i s t r a t o r s .   I n v o l u n t a r y   d i s r u p t i o n s   a r e   u n i n t e n t i o n a l   a n d   c a n   b e   t r i g g e r e d   b y   u n a v o i d a b l e   i s s u e s   l i k e   N o d e s   r u n n i n g   o u t   o f   r e s o u r c e s ,   o r   b y   a c c i d e n t a l   d e l e t i o n s .   P o d   P r i o r i t y   a n d   P r e e m p t i o n N o d e - p r e s s u r e   E v i c t i o n A P I - i n i t i a t e d   E v i c t i o n


Question: What is RuntimeClass?

Answer: RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.apiVersion: node.k8s.io/v1import "k8s.io/api/node/v1"RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/apiVersion: node.k8s.io/v1kind: RuntimeClassmetadata (ObjectMeta)More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatahandler (string), requiredhandler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.overhead (Overhead)overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/Overhead structure represents the resource overhead associated with running a pod.overhead.podFixed (map[string]Quantity)podFixed represents the fixed resource overhead associated with running a pod.scheduling (Scheduling)scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.scheduling.nodeSelector (map[string]string)nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.scheduling.tolerations ([]Toleration)Atomic: will be replaced during a mergetolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .scheduling.tolerations.key (string)Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator mus


Question: How does RuntimeClass work?

Answer: RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.apiVersion: node.k8s.io/v1import "k8s.io/api/node/v1"RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/apiVersion: node.k8s.io/v1kind: RuntimeClassmetadata (ObjectMeta)More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatahandler (string), requiredhandler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.overhead (Overhead)overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/Overhead structure represents the resource overhead associated with running a pod.overhead.podFixed (map[string]Quantity)podFixed represents the fixed resource overhead associated with running a pod.scheduling (Scheduling)scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.scheduling.nodeSelector (map[string]string)nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.scheduling.tolerations ([]Toleration)Atomic: will be replaced during a mergetolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .scheduling.tolerations.key (string)Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator mus


Question: When would you use RuntimeClass?

Answer: RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.apiVersion: node.k8s.io/v1import "k8s.io/api/node/v1"RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/apiVersion: node.k8s.io/v1kind: RuntimeClassmetadata (ObjectMeta)More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatahandler (string), requiredhandler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.overhead (Overhead)overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/Overhead structure represents the resource overhead associated with running a pod.overhead.podFixed (map[string]Quantity)podFixed represents the fixed resource overhead associated with running a pod.scheduling (Scheduling)scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.scheduling.nodeSelector (map[string]string)nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.scheduling.tolerations ([]Toleration)Atomic: will be replaced during a mergetolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .scheduling.tolerations.key (string)Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator mus


Question: What are the benefits of RuntimeClass?

Answer: RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster.apiVersion: node.k8s.io/v1import "k8s.io/api/node/v1"RuntimeClassRuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/apiVersion: node.k8s.io/v1kind: RuntimeClassmetadata (ObjectMeta)More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatahandler (string), requiredhandler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.overhead (Overhead)overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/Overhead structure represents the resource overhead associated with running a pod.overhead.podFixed (map[string]Quantity)podFixed represents the fixed resource overhead associated with running a pod.scheduling (Scheduling)scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.scheduling.nodeSelector (map[string]string)nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.scheduling.tolerations ([]Toleration)Atomic: will be replaced during a mergetolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .scheduling.tolerations.key (string)Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator mus


Question: What is RuntimeClass?

Answer: a p i V e r s i o n :   n o d e . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / n o d e / v 1 "


Question: What is RuntimeClass?

Answer: R u n t i m e C l a s s   d e f i n e s   a   c l a s s   o f   c o n t a i n e r   r u n t i m e   s u p p o r t e d   i n   t h e   c l u s t e r .   T h e   R u n t i m e C l a s s   i s   u s e d   t o   d e t e r m i n e   w h i c h   c o n t a i n e r   r u n t i m e   i s   u s e d   t o   r u n   a l l   c o n t a i n e r s   i n   a   p o d .   R u n t i m e C l a s s e s   a r e   m a n u a l l y   d e f i n e d   b y   a   u s e r   o r   c l u s t e r   p r o v i s i o n e r ,   a n d   r e f e r e n c e d   i n   t h e   P o d S p e c .   T h e   K u b e l e t   i s   r e s p o n s i b l e   f o r   r e s o l v i n g   t h e   R u n t i m e C l a s s N a m e   r e f e r e n c e   b e f o r e   r u n n i n g   t h e   p o d .   F o r   m o r e   d e t a i l s ,   s e e   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / c o n t a i n e r s / r u n t i m e - c l a s s /   a p i V e r s i o n :   n o d e . k 8 s . i o / v 1 k i n d :   R u n t i m e C l a s s m e t a d a t a   ( O b j e c t M e t a ) M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a h a n d l e r   ( s t r i n g ) ,   r e q u i r e d h a n d l e r   s p e c i f i e s   t h e   u n d e r l y i n g   r u n t i m e   a n d   c o n f i g u r a t i o n   t h a t   t h e   C R I   i m p l e m e n t a t i o n   w i l l   u s e   t o   h a n d l e   p o d s   o f   t h i s   c l a s s .   T h e   p o s s i b l e   v a l u e s   a r e   s p e c i f i c   t o   t h e   n o d e   &   C R I   c o n f i g u r a t i o n .   I t   i s   a s s u m e d   t h a t   a l l   h a n d l e r s   a r e   a v a i l a b l e   o n   e v e r y   n o d e ,   a n d   h a n d l e r s   o f   t h e   s a m e   n a m e   a r e   e q u i v a l e n t   o n   e v e r y   n o d e .   F o r   e x a m p l e ,   a   h a n d l e r   c a l l e d   " r u n


Question: What is RuntimeClassList?

Answer: R u n t i m e C l a s s L i s t   i s   a   l i s t   o f   R u n t i m e C l a s s   o b j e c t s .   a p i V e r s i o n :   n o d e . k 8 s . i o / v 1 k i n d :   R u n t i m e C l a s s L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a i t e m s   ( [ ] R u n t i m e C l a s s ) ,   r e q u i r e d i t e m s   i s   a   l i s t   o f   s c h e m a   o b j e c t s .   a p i V e r s i o n :   n o d e . k 8 s . i o / v 1   k i n d :   R u n t i m e C l a s s L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   i t e m s   ( [ ] R u n t i m e C l a s s ) ,   r e q u i r e d   i t e m s   i s   a   l i s t   o f   s c h e m a   o b j e c t s .


Question: What is HTTP Request?

Answer: G E T   / a p i s / n o d e . k 8 s . i o / v 1 / r u n t i m e c l a s s e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R u n t i m e C l a s s p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R u n t i m e C l a s s   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R u n t i m e C l a s s ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / n o d e . k 8 s . i o / v 1 / r u n t i m e c l a s s e s