Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   -   k u b e c t l   c o n t r o l s   t h e   K u b e r n e t e s   c l u s t e r   m a n a g e r   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Guide for Running Windows Containers in Kubernetes?

Answer:
Guide for Running Windows Containers in KubernetesThis page provides a walkthrough for some steps you can follow to run Windows containers using Kubernetes. The page also highlights some Windows specific functionality within Kubernetes.It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. The kubectl commands to interface with the cluster are identical. The examples in this page are provided to jumpstart your experience with Windows containers.ObjectivesConfigure an example deployment to run Windows containers on a Windows node.Before you beginYou should already have access to a Kubernetes cluster that includes a worker node running Windows Server.Getting Started: Deploying a Windows workloadThe example YAML file below deploys a simple webserver application running inside a Windows container.Create a manifest named win-webserver.yaml with the contents below:--- apiVersion: v1 kind: Service metadata: name: win-webserver labels: app: win-webserver spec: ports: # the port that this service should serve on - port: 80 targetPort: 80 selector: app: win-webserver type: NodePort --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: win-webserver name: win-webserver spec: replicas: 2 selector: matchLabels: app: win-webserver template: metadata: labels: app: win-webserver name: win-webserver spec: containers: - name: windowswebserver image: mcr.microsoft.com/windows/servercore:ltsc2019 command: - powershell.exe - -command - "<#code used from https://gist.github.com/19WAS85/5424431#> ; $$listener = New-Object System.Net.HttpListener ; $$listener.Prefixes.Add('http://*:80/') ; $$listener.Start() ; $$callerCounts = @{} ; Write-Host('Listening at http://*:80/') ; while ($$listener.IsListening) { ;$$context = $$listener.GetContext() ;$$requestUrl = $$context.Request.Url ;$$clientIP = $$context.Request.RemoteEndPoint.Address ;$$response = $$context.Response ;Write-Host '' ;Write-Host('> {0}' -f $$requestUrl) ; ;$$count = 1 ;$$k=$$callerCounts.Get_Item($$clientIP) ;if ($$k -ne $$null) { $$count += $$k } ;$$callerCounts.Set_Item($$clientIP, $$count) ;$$ip=(Get-NetAdapter | Get-NetIpAddress); $$header='
Windows Container Web Server
' ;$$callerCountsString='' ;$$callerCounts.Keys | % { $$callerCountsString+='
IP {0} callerCount {1} ' -f $$ip[1].IPAddress,$$callerCounts.Item($$_) } ;$$footer='' ;$$content='{0}{1}{2}' -f $$header,$$callerCountsString,$$footer ;Write-Output $$content ;$$buffer = [System.Text.Encoding]::UTF8.GetBytes($$content) ;$$response.ContentLength64 = $$buffer.Length ;$$response.OutputStream.Write($$buffer, 0, $$buffer.Length) ;$$response.Close() ;$$responseStatus = $$response.StatusCode ;Write-Host('< {0}' -f $$responseStatus) } ; " nodeSelector: kubernetes.io/os: windows Note:Port mapping is also supported, but for simplicity this example exposes port 80 of the container directly to the Service.Check that


Question: How does Guide for Running Windows Containers in Kubernetes work?

Answer:
Guide for Running Windows Containers in KubernetesThis page provides a walkthrough for some steps you can follow to run Windows containers using Kubernetes. The page also highlights some Windows specific functionality within Kubernetes.It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. The kubectl commands to interface with the cluster are identical. The examples in this page are provided to jumpstart your experience with Windows containers.ObjectivesConfigure an example deployment to run Windows containers on a Windows node.Before you beginYou should already have access to a Kubernetes cluster that includes a worker node running Windows Server.Getting Started: Deploying a Windows workloadThe example YAML file below deploys a simple webserver application running inside a Windows container.Create a manifest named win-webserver.yaml with the contents below:--- apiVersion: v1 kind: Service metadata: name: win-webserver labels: app: win-webserver spec: ports: # the port that this service should serve on - port: 80 targetPort: 80 selector: app: win-webserver type: NodePort --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: win-webserver name: win-webserver spec: replicas: 2 selector: matchLabels: app: win-webserver template: metadata: labels: app: win-webserver name: win-webserver spec: containers: - name: windowswebserver image: mcr.microsoft.com/windows/servercore:ltsc2019 command: - powershell.exe - -command - "<#code used from https://gist.github.com/19WAS85/5424431#> ; $$listener = New-Object System.Net.HttpListener ; $$listener.Prefixes.Add('http://*:80/') ; $$listener.Start() ; $$callerCounts = @{} ; Write-Host('Listening at http://*:80/') ; while ($$listener.IsListening) { ;$$context = $$listener.GetContext() ;$$requestUrl = $$context.Request.Url ;$$clientIP = $$context.Request.RemoteEndPoint.Address ;$$response = $$context.Response ;Write-Host '' ;Write-Host('> {0}' -f $$requestUrl) ; ;$$count = 1 ;$$k=$$callerCounts.Get_Item($$clientIP) ;if ($$k -ne $$null) { $$count += $$k } ;$$callerCounts.Set_Item($$clientIP, $$count) ;$$ip=(Get-NetAdapter | Get-NetIpAddress); $$header='
Windows Container Web Server
' ;$$callerCountsString='' ;$$callerCounts.Keys | % { $$callerCountsString+='
IP {0} callerCount {1} ' -f $$ip[1].IPAddress,$$callerCounts.Item($$_) } ;$$footer='' ;$$content='{0}{1}{2}' -f $$header,$$callerCountsString,$$footer ;Write-Output $$content ;$$buffer = [System.Text.Encoding]::UTF8.GetBytes($$content) ;$$response.ContentLength64 = $$buffer.Length ;$$response.OutputStream.Write($$buffer, 0, $$buffer.Length) ;$$response.Close() ;$$responseStatus = $$response.StatusCode ;Write-Host('< {0}' -f $$responseStatus) } ; " nodeSelector: kubernetes.io/os: windows Note:Port mapping is also supported, but for simplicity this example exposes port 80 of the container directly to the Service.Check that


Question: When would you use Guide for Running Windows Containers in Kubernetes?

Answer:
Guide for Running Windows Containers in KubernetesThis page provides a walkthrough for some steps you can follow to run Windows containers using Kubernetes. The page also highlights some Windows specific functionality within Kubernetes.It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. The kubectl commands to interface with the cluster are identical. The examples in this page are provided to jumpstart your experience with Windows containers.ObjectivesConfigure an example deployment to run Windows containers on a Windows node.Before you beginYou should already have access to a Kubernetes cluster that includes a worker node running Windows Server.Getting Started: Deploying a Windows workloadThe example YAML file below deploys a simple webserver application running inside a Windows container.Create a manifest named win-webserver.yaml with the contents below:--- apiVersion: v1 kind: Service metadata: name: win-webserver labels: app: win-webserver spec: ports: # the port that this service should serve on - port: 80 targetPort: 80 selector: app: win-webserver type: NodePort --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: win-webserver name: win-webserver spec: replicas: 2 selector: matchLabels: app: win-webserver template: metadata: labels: app: win-webserver name: win-webserver spec: containers: - name: windowswebserver image: mcr.microsoft.com/windows/servercore:ltsc2019 command: - powershell.exe - -command - "<#code used from https://gist.github.com/19WAS85/5424431#> ; $$listener = New-Object System.Net.HttpListener ; $$listener.Prefixes.Add('http://*:80/') ; $$listener.Start() ; $$callerCounts = @{} ; Write-Host('Listening at http://*:80/') ; while ($$listener.IsListening) { ;$$context = $$listener.GetContext() ;$$requestUrl = $$context.Request.Url ;$$clientIP = $$context.Request.RemoteEndPoint.Address ;$$response = $$context.Response ;Write-Host '' ;Write-Host('> {0}' -f $$requestUrl) ; ;$$count = 1 ;$$k=$$callerCounts.Get_Item($$clientIP) ;if ($$k -ne $$null) { $$count += $$k } ;$$callerCounts.Set_Item($$clientIP, $$count) ;$$ip=(Get-NetAdapter | Get-NetIpAddress); $$header='
Windows Container Web Server
' ;$$callerCountsString='' ;$$callerCounts.Keys | % { $$callerCountsString+='
IP {0} callerCount {1} ' -f $$ip[1].IPAddress,$$callerCounts.Item($$_) } ;$$footer='' ;$$content='{0}{1}{2}' -f $$header,$$callerCountsString,$$footer ;Write-Output $$content ;$$buffer = [System.Text.Encoding]::UTF8.GetBytes($$content) ;$$response.ContentLength64 = $$buffer.Length ;$$response.OutputStream.Write($$buffer, 0, $$buffer.Length) ;$$response.Close() ;$$responseStatus = $$response.StatusCode ;Write-Host('< {0}' -f $$responseStatus) } ; " nodeSelector: kubernetes.io/os: windows Note:Port mapping is also supported, but for simplicity this example exposes port 80 of the container directly to the Service.Check that


Question: What are the benefits of Guide for Running Windows Containers in Kubernetes?

Answer:
Guide for Running Windows Containers in KubernetesThis page provides a walkthrough for some steps you can follow to run Windows containers using Kubernetes. The page also highlights some Windows specific functionality within Kubernetes.It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. The kubectl commands to interface with the cluster are identical. The examples in this page are provided to jumpstart your experience with Windows containers.ObjectivesConfigure an example deployment to run Windows containers on a Windows node.Before you beginYou should already have access to a Kubernetes cluster that includes a worker node running Windows Server.Getting Started: Deploying a Windows workloadThe example YAML file below deploys a simple webserver application running inside a Windows container.Create a manifest named win-webserver.yaml with the contents below:--- apiVersion: v1 kind: Service metadata: name: win-webserver labels: app: win-webserver spec: ports: # the port that this service should serve on - port: 80 targetPort: 80 selector: app: win-webserver type: NodePort --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: win-webserver name: win-webserver spec: replicas: 2 selector: matchLabels: app: win-webserver template: metadata: labels: app: win-webserver name: win-webserver spec: containers: - name: windowswebserver image: mcr.microsoft.com/windows/servercore:ltsc2019 command: - powershell.exe - -command - "<#code used from https://gist.github.com/19WAS85/5424431#> ; $$listener = New-Object System.Net.HttpListener ; $$listener.Prefixes.Add('http://*:80/') ; $$listener.Start() ; $$callerCounts = @{} ; Write-Host('Listening at http://*:80/') ; while ($$listener.IsListening) { ;$$context = $$listener.GetContext() ;$$requestUrl = $$context.Request.Url ;$$clientIP = $$context.Request.RemoteEndPoint.Address ;$$response = $$context.Response ;Write-Host '' ;Write-Host('> {0}' -f $$requestUrl) ; ;$$count = 1 ;$$k=$$callerCounts.Get_Item($$clientIP) ;if ($$k -ne $$null) { $$count += $$k } ;$$callerCounts.Set_Item($$clientIP, $$count) ;$$ip=(Get-NetAdapter | Get-NetIpAddress); $$header='
Windows Container Web Server
' ;$$callerCountsString='' ;$$callerCounts.Keys | % { $$callerCountsString+='
IP {0} callerCount {1} ' -f $$ip[1].IPAddress,$$callerCounts.Item($$_) } ;$$footer='' ;$$content='{0}{1}{2}' -f $$header,$$callerCountsString,$$footer ;Write-Output $$content ;$$buffer = [System.Text.Encoding]::UTF8.GetBytes($$content) ;$$response.ContentLength64 = $$buffer.Length ;$$response.OutputStream.Write($$buffer, 0, $$buffer.Length) ;$$response.Close() ;$$responseStatus = $$response.StatusCode ;Write-Host('< {0}' -f $$responseStatus) } ; " nodeSelector: kubernetes.io/os: windows Note:Port mapping is also supported, but for simplicity this example exposes port 80 of the container directly to the Service.Check that


Question: What is Guide for Running Windows Containers in Kubernetes?

Answer: T h i s   p a g e   p r o v i d e s   a   w a l k t h r o u g h   f o r   s o m e   s t e p s   y o u   c a n   f o l l o w   t o   r u n   W i n d o w s   c o n t a i n e r s   u s i n g   K u b e r n e t e s .   T h e   p a g e   a l s o   h i g h l i g h t s   s o m e   W i n d o w s   s p e c i f i c   f u n c t i o n a l i t y   w i t h i n   K u b e r n e t e s .   I t   i s   i m p o r t a n t   t o   n o t e   t h a t   c r e a t i n g   a n d   d e p l o y i n g   s e r v i c e s   a n d   w o r k l o a d s   o n   K u b e r n e t e s   b e h a v e s   i n   m u c h   t h e   s a m e   w a y   f o r   L i n u x   a n d   W i n d o w s   c o n t a i n e r s .   T h e   k u b e c t l   c o m m a n d s   t o   i n t e r f a c e   w i t h   t h e   c l u s t e r   a r e   i d e n t i c a l .   T h e   e x a m p l e s   i n   t h i s   p a g e   a r e   p r o v i d e d   t o   j u m p s t a r t   y o u r   e x p e r i e n c e   w i t h   W i n d o w s   c o n t a i n e r s .


Question: What is Objectives?

Answer: C o n f i g u r e   a n   e x a m p l e   d e p l o y m e n t   t o   r u n   W i n d o w s   c o n t a i n e r s   o n   a   W i n d o w s   n o d e .


Question: What is Before you begin?

Answer: Y o u   s h o u l d   a l r e a d y   h a v e   a c c e s s   t o   a   K u b e r n e t e s   c l u s t e r   t h a t   i n c l u d e s   a   w o r k e r   n o d e   r u n n i n g   W i n d o w s   S e r v e r .


Question: What is Getting Started: Deploying a Windows workload?

Answer: T h e   e x a m p l e   Y A M L   f i l e   b e l o w   d e p l o y s   a   s i m p l e   w e b s e r v e r   a p p l i c a t i o n   r u n n i n g   i n s i d e   a   W i n d o w s   c o n t a i n e r .   C r e a t e   a   m a n i f e s t   n a m e d   w i n - w e b s e r v e r . y a m l   w i t h   t h e   c o n t e n t s   b e l o w :   - - -   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e   m e t a d a t a :   n a m e :   w i n - w e b s e r v e r   l a b e l s :   a p p :   w i n - w e b s e r v e r   s p e c :   p o r t s :   #   t h e   p o r t   t h a t   t h i s   s e r v i c e   s h o u l d   s e r v e   o n   -   p o r t :   8 0   t a r g e t P o r t :   8 0   s e l e c t o r :   a p p :   w i n - w e b s e r v e r   t y p e :   N o d e P o r t   - - -   a p i V e r s i o n :   a p p s / v 1   k i n d :   D e p l o y m e n t   m e t a d a t a :   l a b e l s :   a p p :   w i n - w e b s e r v e r   n a m e :   w i n - w e b s e r v e r   s p e c :   r e p l i c a s :   2   s e l e c t o r :   m a t c h L a b e l s :   a p p :   w i n - w e b s e r v e r   t e m p l a t e :   m e t a d a t a :   l a b e l s :   a p p :   w i n - w e b s e r v e r   n a m e :   w i n - w e b s e r v e r   s p e c :   c o n t a i n e r s :   -   n a m e :   w i n d o w s w e b s e r v e r   i m a g e :   m c r . m i c r o s o f t . c o m / w i n d o w s / s e r v e r c o r e : l t s c 2 0 1 9   c o m m a n d :   -   p o w e r s h e l l . e x e   -   - c o m m a n d   -   " < # c o d e   u s e d   f r o m   h t t p s : / / g i s t . g i t h u b . c o m / 1 9 W A S 8 5 / 5 4 2 4 4 3 1 # >   ;   $ $ l i s t e n e r   =   N e w - O b j e c t   S y s t e m . N e t . H t t p L i s t e n e r   ;   $ $ l i s t e n e r . P r e f i x e s . A d d ( ' h t t p : / / * : 8 0 / ' )   ;   $ $ l i s t e n e r . S t a r t ( )   ;   $ $ c a l l e r C o u n t s   =   @ { }   ;   W r i t e - H o s t ( ' L i s t e n i n g   a t   h t t p : / / * : 8 0 / ' )   ;   w h i l e   ( $ $ l i


Question: What is Note:?

Answer: C h e c k   t h a t   a l l   n o d e s   a r e   h e a l t h y : k u b e c t l   g e t   n o d e s   D e p l o y   t h e   s e r v i c e   a n d   w a t c h   f o r   p o d   u p d a t e s : k u b e c t l   a p p l y   - f   w i n - w e b s e r v e r . y a m l   k u b e c t l   g e t   p o d s   - o   w i d e   - w   W h e n   t h e   s e r v i c e   i s   d e p l o y e d   c o r r e c t l y   b o t h   P o d s   a r e   m a r k e d   a s   R e a d y .   T o   e x i t   t h e   w a t c h   c o m m a n d ,   p r e s s   C t r l + C . C h e c k   t h a t   t h e   d e p l o y m e n t   s u c c e e d e d .   T o   v e r i f y : S e v e r a l   p o d s   l i s t e d   f r o m   t h e   L i n u x   c o n t r o l   p l a n e   n o d e ,   u s e   k u b e c t l   g e t   p o d s N o d e - t o - p o d   c o m m u n i c a t i o n   a c r o s s   t h e   n e t w o r k ,   c u r l   p o r t   8 0   o f   y o u r   p o d   I P s   f r o m   t h e   L i n u x   c o n t r o l   p l a n e   n o d e   t o   c h e c k   f o r   a   w e b   s e r v e r   r e s p o n s e P o d - t o - p o d   c o m m u n i c a t i o n ,   p i n g   b e t w e e n   p o d s   ( a n d   a c r o s s   h o s t s ,   i f   y o u   h a v e   m o r e   t h a n   o n e   W i n d o w s   n o d e )   u s i n g   k u b e c t l   e x e c S e r v i c e - t o - p o d   c o m m u n i c a t i o n ,   c u r l   t h e   v i r t u a l   s e r v i c e   I P   ( s e e n   u n d e r   k u b e c t l   g e t   s e r v i c e s )   f r o m   t h e   L i n u x   c o n t r o l   p l a n e   n o d e   a n d   f r o m   i n d i v i d u a l   p o d s S e r v i c e   d i s c o v e r y ,   c u r l   t h e   s e r v i c e   n a m e   w i t h   t h e   K u b e r n e t e s   d e f a u l t   D N S   s u f f i x I n b o u n d   c o n n e c t i v i t y ,   c u r l   t h e   N o d e P o r t   f r o m   t h e   L i n u x   c o n t r o l   p l a n e   n o d e   o r   m a c h i n e s   o u t s i d e   o f   t h e   c l u s t e r O u t b o u n


Question: What is Capturing logs from workloads?

Answer: L o g s   a r e   a n   i m p o r t a n t   e l e m e n t   o f   o b s e r v a b i l i t y ;   t h e y   e n a b l e   u s e r s   t o   g a i n   i n s i g h t s   i n t o   t h e   o p e r a t i o n a l   a s p e c t   o f   w o r k l o a d s   a n d   a r e   a   k e y   i n g r e d i e n t   t o   t r o u b l e s h o o t i n g   i s s u e s .   B e c a u s e   W i n d o w s   c o n t a i n e r s   a n d   w o r k l o a d s   i n s i d e   W i n d o w s   c o n t a i n e r s   b e h a v e   d i f f e r e n t l y   f r o m   L i n u x   c o n t a i n e r s ,   u s e r s   h a d   a   h a r d   t i m e   c o l l e c t i n g   l o g s ,   l i m i t i n g   o p e r a t i o n a l   v i s i b i l i t y .   W i n d o w s   w o r k l o a d s   f o r   e x a m p l e   a r e   u s u a l l y   c o n f i g u r e d   t o   l o g   t o   E T W   ( E v e n t   T r a c i n g   f o r   W i n d o w s )   o r   p u s h   e n t r i e s   t o   t h e   a p p l i c a t i o n   e v e n t   l o g .   L o g M o n i t o r ,   a n   o p e n   s o u r c e   t o o l   b y   M i c r o s o f t ,   i s   t h e   r e c o m m e n d e d   w a y   t o   m o n i t o r   c o n f i g u r e d   l o g   s o u r c e s   i n s i d e   a   W i n d o w s   c o n t a i n e r .   L o g M o n i t o r   s u p p o r t s   m o n i t o r i n g   e v e n t   l o g s ,   E T W   p r o v i d e r s ,   a n d   c u s t o m   a p p l i c a t i o n   l o g s ,   p i p i n g   t h e m   t o   S T D O U T   f o r   c o n s u m p t i o n   b y   k u b e c t l   l o g s   < p o d > .   F o l l o w   t h e   i n s t r u c t i o n s   i n   t h e   L o g M o n i t o r   G i t H u b   p a g e   t o   c o p y   i t s   b i n a r i e s   a n d   c o n f i g u r a t i o n   f i l e s   t o   a l l   y o u r   c o n t a i n e r s   a n d   a d d   t h e   n e c e s s a r y   e n t r y p o i n t s   f o r   L o g M o n i t o r   t o   p u s h   y o u r   l o g s   t o   S T D O U T .


Question: What is Using configurable Container usernames?

Answer: W i n d o w s   c o n t a i n e r s   c a n   b e   c o n f i g u r e d   t o   r u n   t h e i r   e n t r y p o i n t s   a n d   p r o c e s s e s   w i t h   d i f f e r e n t   u s e r n a m e s   t h a n   t h e   i m a g e   d e f a u l t s .   L e a r n   m o r e   a b o u t   i t   h e r e .


Question: What is Managing Workload Identity with Group Managed Service Accounts?

Answer: W i n d o w s   c o n t a i n e r   w o r k l o a d s   c a n   b e   c o n f i g u r e d   t o   u s e   G r o u p   M a n a g e d   S e r v i c e   A c c o u n t s   ( G M S A ) .   G r o u p   M a n a g e d   S e r v i c e   A c c o u n t s   a r e   a   s p e c i f i c   t y p e   o f   A c t i v e   D i r e c t o r y   a c c o u n t   t h a t   p r o v i d e   a u t o m a t i c   p a s s w o r d   m a n a g e m e n t ,   s i m p l i f i e d   s e r v i c e   p r i n c i p a l   n a m e   ( S P N )   m a n a g e m e n t ,   a n d   t h e   a b i l i t y   t o   d e l e g a t e   t h e   m a n a g e m e n t   t o   o t h e r   a d m i n i s t r a t o r s   a c r o s s   m u l t i p l e   s e r v e r s .   C o n t a i n e r s   c o n f i g u r e d   w i t h   a   G M S A   c a n   a c c e s s   e x t e r n a l   A c t i v e   D i r e c t o r y   D o m a i n   r e s o u r c e s   w h i l e   c a r r y i n g   t h e   i d e n t i t y   c o n f i g u r e d   w i t h   t h e   G M S A .   L e a r n   m o r e   a b o u t   c o n f i g u r i n g   a n d   u s i n g   G M S A   f o r   W i n d o w s   c o n t a i n e r s   h e r e .


Question: What is Taints and tolerations?

Answer: U s e r s   n e e d   t o   u s e   s o m e   c o m b i n a t i o n   o f   t a i n t   a n d   n o d e   s e l e c t o r s   i n   o r d e r   t o   s c h e d u l e   L i n u x   a n d   W i n d o w s   w o r k l o a d s   t o   t h e i r   r e s p e c t i v e   O S - s p e c i f i c   n o d e s .   T h e   r e c o m m e n d e d   a p p r o a c h   i s   o u t l i n e d   b e l o w ,   w i t h   o n e   o f   i t s   m a i n   g o a l s   b e i n g   t h a t   t h i s   a p p r o a c h   s h o u l d   n o t   b r e a k   c o m p a t i b i l i t y   f o r   e x i s t i n g   L i n u x   w o r k l o a d s .   Y o u   c a n   ( a n d   s h o u l d )   s e t   . s p e c . o s . n a m e   f o r   e a c h   P o d ,   t o   i n d i c a t e   t h e   o p e r a t i n g   s y s t e m   t h a t   t h e   c o n t a i n e r s   i n   t h a t   P o d   a r e   d e s i g n e d   f o r .   F o r   P o d s   t h a t   r u n   L i n u x   c o n t a i n e r s ,   s e t   . s p e c . o s . n a m e   t o   l i n u x .   F o r   P o d s   t h a t   r u n   W i n d o w s   c o n t a i n e r s ,   s e t   . s p e c . o s . n a m e   t o   w i n d o w s .


Question: What is Note:?

Answer: T h e   s c h e d u l e r   d o e s   n o t   u s e   t h e   v a l u e   o f   . s p e c . o s . n a m e   w h e n   a s s i g n i n g   P o d s   t o   n o d e s .   Y o u   s h o u l d   u s e   n o r m a l   K u b e r n e t e s   m e c h a n i s m s   f o r   a s s i g n i n g   p o d s   t o   n o d e s   t o   e n s u r e   t h a t   t h e   c o n t r o l   p l a n e   f o r   y o u r   c l u s t e r   p l a c e s   p o d s   o n t o   n o d e s   t h a t   a r e   r u n n i n g   t h e   a p p r o p r i a t e   o p e r a t i n g   s y s t e m .   T h e   . s p e c . o s . n a m e   v a l u e   h a s   n o   e f f e c t   o n   t h e   s c h e d u l i n g   o f   t h e   W i n d o w s   p o d s ,   s o   t a i n t s   a n d   t o l e r a t i o n s   ( o r   n o d e   s e l e c t o r s )   a r e   s t i l l   r e q u i r e d   t o   e n s u r e   t h a t   t h e   W i n d o w s   p o d s   l a n d   o n t o   a p p r o p r i a t e   W i n d o w s   n o d e s .


Question: What is Ensuring OS-specific workloads land on the appropriate container host?

Answer: U s e r s   c a n   e n s u r e   W i n d o w s   c o n t a i n e r s   c a n   b e   s c h e d u l e d   o n   t h e   a p p r o p r i a t e   h o s t   u s i n g   t a i n t s   a n d   t o l e r a t i o n s .   A l l   K u b e r n e t e s   n o d e s   r u n n i n g   K u b e r n e t e s   1 . 3 4   h a v e   t h e   f o l l o w i n g   d e f a u l t   l a b e l s :   k u b e r n e t e s . i o / o s   =   [ w i n d o w s | l i n u x ] k u b e r n e t e s . i o / a r c h   =   [ a m d 6 4 | a r m 6 4 | . . . ]   I f   a   P o d   s p e c i f i c a t i o n   d o e s   n o t   s p e c i f y   a   n o d e S e l e c t o r   s u c h   a s   " k u b e r n e t e s . i o / o s " :   w i n d o w s ,   i t   i s   p o s s i b l e   t h e   P o d   c a n   b e   s c h e d u l e d   o n   a n y   h o s t ,   W i n d o w s   o r   L i n u x .   T h i s   c a n   b e   p r o b l e m a t i c   s i n c e   a   W i n d o w s   c o n t a i n e r   c a n   o n l y   r u n   o n   W i n d o w s   a n d   a   L i n u x   c o n t a i n e r   c a n   o n l y   r u n   o n   L i n u x .   T h e   b e s t   p r a c t i c e   f o r   K u b e r n e t e s   1 . 3 4   i s   t o   u s e   a   n o d e S e l e c t o r .   H o w e v e r ,   i n   m a n y   c a s e s   u s e r s   h a v e   a   p r e - e x i s t i n g   l a r g e   n u m b e r   o f   d e p l o y m e n t s   f o r   L i n u x   c o n t a i n e r s ,   a s   w e l l   a s   a n   e c o s y s t e m   o f   o f f - t h e - s h e l f   c o n f i g u r a t i o n s ,   s u c h   a s   c o m m u n i t y   H e l m   c h a r t s ,   a n d   p r o g r a m m a t i c   P o d   g e n e r a t i o n   c a s e s ,   s u c h   a s   w i t h   o p e r a t o r s .   I n   t h o s e   s i t u a t i o n s ,   y o u   m a y   b e   h e s i t a n t   t o   m a k e   t h e   c o n f i g u r a t i o n   c h a n g e   t o   a d d   n o d e S e l e c t o r   f i e l d s   t o   a l l   P o d s   a n d   P o d   t e m p l a t e s .   T h e   a l t e r n a t


Question: What is Handling multiple Windows versions in the same cluster?

Answer: T h e   W i n d o w s   S e r v e r   v e r s i o n   u s e d   b y   e a c h   p o d   m u s t   m a t c h   t h a t   o f   t h e   n o d e .   I f   y o u   w a n t   t o   u s e   m u l t i p l e   W i n d o w s   S e r v e r   v e r s i o n s   i n   t h e   s a m e   c l u s t e r ,   t h e n   y o u   s h o u l d   s e t   a d d i t i o n a l   n o d e   l a b e l s   a n d   n o d e S e l e c t o r   f i e l d s .   K u b e r n e t e s   a u t o m a t i c a l l y   a d d s   a   l a b e l ,   n o d e . k u b e r n e t e s . i o / w i n d o w s - b u i l d   t o   s i m p l i f y   t h i s .   T h i s   l a b e l   r e f l e c t s   t h e   W i n d o w s   m a j o r ,   m i n o r ,   a n d   b u i l d   n u m b e r   t h a t   n e e d   t o   m a t c h   f o r   c o m p a t i b i l i t y .   H e r e   a r e   v a l u e s   u s e d   f o r   e a c h   W i n d o w s   S e r v e r   v e r s i o n :


Question: What is Simplifying with RuntimeClass?

Answer: R u n t i m e C l a s s   c a n   b e   u s e d   t o   s i m p l i f y   t h e   p r o c e s s   o f   u s i n g   t a i n t s   a n d   t o l e r a t i o n s .   A   c l u s t e r   a d m i n i s t r a t o r   c a n   c r e a t e   a   R u n t i m e C l a s s   o b j e c t   w h i c h   i s   u s e d   t o   e n c a p s u l a t e   t h e s e   t a i n t s   a n d   t o l e r a t i o n s .   S a v e   t h i s   f i l e   t o   r u n t i m e C l a s s e s . y m l .   I t   i n c l u d e s   t h e   a p p r o p r i a t e   n o d e S e l e c t o r   f o r   t h e   W i n d o w s   O S ,   a r c h i t e c t u r e ,   a n d   v e r s i o n . - - -   a p i V e r s i o n :   n o d e . k 8 s . i o / v 1   k i n d :   R u n t i m e C l a s s   m e t a d a t a :   n a m e :   w i n d o w s - 2 0 1 9   h a n d l e r :   e x a m p l e - c o n t a i n e r - r u n t i m e - h a n d l e r   s c h e d u l i n g :   n o d e S e l e c t o r :   k u b e r n e t e s . i o / o s :   ' w i n d o w s '   k u b e r n e t e s . i o / a r c h :   ' a m d 6 4 '   n o d e . k u b e r n e t e s . i o / w i n d o w s - b u i l d :   ' 1 0 . 0 . 1 7 7 6 3 '   t o l e r a t i o n s :   -   e f f e c t :   N o S c h e d u l e   k e y :   o s   o p e r a t o r :   E q u a l   v a l u e :   " w i n d o w s "   R u n   k u b e c t l   c r e a t e   - f   r u n t i m e C l a s s e s . y m l   u s i n g   a s   a   c l u s t e r   a d m i n i s t r a t o r A d d   r u n t i m e C l a s s N a m e :   w i n d o w s - 2 0 1 9   a s   a p p r o p r i a t e   t o   P o d   s p e c s F o r   e x a m p l e : - - -   a p i V e r s i o n :   a p p s / v 1   k i n d :   D e p l o y m e n t   m e t a d a t a :   n a m e :   i i s - 2 0 1 9   l a b e l s :   a p p :   i i s - 2 0 1 9   s p e c :   r e p l i c a s :   1   t e m p l a t e :   m e t a d a t a :   n a m e :   i i s - 2 0 1 9   l a b e l s :   a p p :   i i s - 2 0 1 9   s p e c :   r u n t i m e C l a s s N a m e :   w i n d o w s - 2 0 1 9   c o n t


Question: What is Reserve Compute Resources for System Daemons?

Answer: Reserve Compute Resources for System DaemonsKubernetes nodes can be scheduled to Capacity. Pods can consume all the available capacity on a node by default. This is an issue because nodes typically run quite a few system daemons that power the OS and Kubernetes itself. Unless resources are set aside for these system daemons, pods and system daemons compete for resources and lead to resource starvation issues on the node.The kubelet exposes a feature named 'Node Allocatable' that helps to reserve compute resources for system daemons. Kubernetes recommends cluster administrators to configure 'Node Allocatable' based on their workload density on each node.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou can configure below kubelet configuration settings using the kubelet configuration file.Node Allocatable'Allocatable' on a Kubernetes node is defined as the amount of compute resources that are available for pods. The scheduler does not over-subscribe 'Allocatable'. 'CPU', 'memory' and 'ephemeral-storage' are supported as of now.Node Allocatable is exposed as part of v1.Node object in the API and as part of kubectl describe node in the CLI.Resources can be reserved for two categories of system daemons in the kubelet.Enabling QoS and Pod level cgroupsTo properly enforce node allocatable constraints on the node, you must enable the new cgroup hierarchy via the cgroupsPerQOS setting. This setting is enabled by default. When enabled, the kubelet will parent all end-user pods under a cgroup hierarchy managed by the kubelet.Configuring a cgroup driverThe kubelet supports manipulation of the cgroup hierarchy on the host using a cgroup driver. The driver is configured via the cgroupDriver setting.The supported values are the following:cgroupfs is the default driver that performs direct manipulation of the cgroup filesystem on the host in order to manage cgroup sandboxes.systemd is an alternative driver that manages cgroup sandboxes using transient slices for resources that are supported by that init system.Depending on the configuration of the associated container runtime, operators may have to choose a particular cgroup driver to ensure proper system behavior. For example, if operators use the systemd cgroup driver provided by the containerd runtime, the kubelet must be configured to use the systemd cgroup driver.Kube ReservedKubeletConfiguration Setting: kubeReserved: {}. Example value {cpu: 100m, memory: 100Mi, ephemeral-storage: 1Gi, pid=1000}KubeletConfiguration Setting: kubeReservedCgroup: ""kubeReserved is meant to capture resource reservation for kubernetes system


Question: How does Reserve Compute Resources for System Daemons work?

Answer: Reserve Compute Resources for System DaemonsKubernetes nodes can be scheduled to Capacity. Pods can consume all the available capacity on a node by default. This is an issue because nodes typically run quite a few system daemons that power the OS and Kubernetes itself. Unless resources are set aside for these system daemons, pods and system daemons compete for resources and lead to resource starvation issues on the node.The kubelet exposes a feature named 'Node Allocatable' that helps to reserve compute resources for system daemons. Kubernetes recommends cluster administrators to configure 'Node Allocatable' based on their workload density on each node.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou can configure below kubelet configuration settings using the kubelet configuration file.Node Allocatable'Allocatable' on a Kubernetes node is defined as the amount of compute resources that are available for pods. The scheduler does not over-subscribe 'Allocatable'. 'CPU', 'memory' and 'ephemeral-storage' are supported as of now.Node Allocatable is exposed as part of v1.Node object in the API and as part of kubectl describe node in the CLI.Resources can be reserved for two categories of system daemons in the kubelet.Enabling QoS and Pod level cgroupsTo properly enforce node allocatable constraints on the node, you must enable the new cgroup hierarchy via the cgroupsPerQOS setting. This setting is enabled by default. When enabled, the kubelet will parent all end-user pods under a cgroup hierarchy managed by the kubelet.Configuring a cgroup driverThe kubelet supports manipulation of the cgroup hierarchy on the host using a cgroup driver. The driver is configured via the cgroupDriver setting.The supported values are the following:cgroupfs is the default driver that performs direct manipulation of the cgroup filesystem on the host in order to manage cgroup sandboxes.systemd is an alternative driver that manages cgroup sandboxes using transient slices for resources that are supported by that init system.Depending on the configuration of the associated container runtime, operators may have to choose a particular cgroup driver to ensure proper system behavior. For example, if operators use the systemd cgroup driver provided by the containerd runtime, the kubelet must be configured to use the systemd cgroup driver.Kube ReservedKubeletConfiguration Setting: kubeReserved: {}. Example value {cpu: 100m, memory: 100Mi, ephemeral-storage: 1Gi, pid=1000}KubeletConfiguration Setting: kubeReservedCgroup: ""kubeReserved is meant to capture resource reservation for kubernetes system


Question: When would you use Reserve Compute Resources for System Daemons?

Answer: Reserve Compute Resources for System DaemonsKubernetes nodes can be scheduled to Capacity. Pods can consume all the available capacity on a node by default. This is an issue because nodes typically run quite a few system daemons that power the OS and Kubernetes itself. Unless resources are set aside for these system daemons, pods and system daemons compete for resources and lead to resource starvation issues on the node.The kubelet exposes a feature named 'Node Allocatable' that helps to reserve compute resources for system daemons. Kubernetes recommends cluster administrators to configure 'Node Allocatable' based on their workload density on each node.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou can configure below kubelet configuration settings using the kubelet configuration file.Node Allocatable'Allocatable' on a Kubernetes node is defined as the amount of compute resources that are available for pods. The scheduler does not over-subscribe 'Allocatable'. 'CPU', 'memory' and 'ephemeral-storage' are supported as of now.Node Allocatable is exposed as part of v1.Node object in the API and as part of kubectl describe node in the CLI.Resources can be reserved for two categories of system daemons in the kubelet.Enabling QoS and Pod level cgroupsTo properly enforce node allocatable constraints on the node, you must enable the new cgroup hierarchy via the cgroupsPerQOS setting. This setting is enabled by default. When enabled, the kubelet will parent all end-user pods under a cgroup hierarchy managed by the kubelet.Configuring a cgroup driverThe kubelet supports manipulation of the cgroup hierarchy on the host using a cgroup driver. The driver is configured via the cgroupDriver setting.The supported values are the following:cgroupfs is the default driver that performs direct manipulation of the cgroup filesystem on the host in order to manage cgroup sandboxes.systemd is an alternative driver that manages cgroup sandboxes using transient slices for resources that are supported by that init system.Depending on the configuration of the associated container runtime, operators may have to choose a particular cgroup driver to ensure proper system behavior. For example, if operators use the systemd cgroup driver provided by the containerd runtime, the kubelet must be configured to use the systemd cgroup driver.Kube ReservedKubeletConfiguration Setting: kubeReserved: {}. Example value {cpu: 100m, memory: 100Mi, ephemeral-storage: 1Gi, pid=1000}KubeletConfiguration Setting: kubeReservedCgroup: ""kubeReserved is meant to capture resource reservation for kubernetes system


Question: What are the benefits of Reserve Compute Resources for System Daemons?

Answer: Reserve Compute Resources for System DaemonsKubernetes nodes can be scheduled to Capacity. Pods can consume all the available capacity on a node by default. This is an issue because nodes typically run quite a few system daemons that power the OS and Kubernetes itself. Unless resources are set aside for these system daemons, pods and system daemons compete for resources and lead to resource starvation issues on the node.The kubelet exposes a feature named 'Node Allocatable' that helps to reserve compute resources for system daemons. Kubernetes recommends cluster administrators to configure 'Node Allocatable' based on their workload density on each node.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou can configure below kubelet configuration settings using the kubelet configuration file.Node Allocatable'Allocatable' on a Kubernetes node is defined as the amount of compute resources that are available for pods. The scheduler does not over-subscribe 'Allocatable'. 'CPU', 'memory' and 'ephemeral-storage' are supported as of now.Node Allocatable is exposed as part of v1.Node object in the API and as part of kubectl describe node in the CLI.Resources can be reserved for two categories of system daemons in the kubelet.Enabling QoS and Pod level cgroupsTo properly enforce node allocatable constraints on the node, you must enable the new cgroup hierarchy via the cgroupsPerQOS setting. This setting is enabled by default. When enabled, the kubelet will parent all end-user pods under a cgroup hierarchy managed by the kubelet.Configuring a cgroup driverThe kubelet supports manipulation of the cgroup hierarchy on the host using a cgroup driver. The driver is configured via the cgroupDriver setting.The supported values are the following:cgroupfs is the default driver that performs direct manipulation of the cgroup filesystem on the host in order to manage cgroup sandboxes.systemd is an alternative driver that manages cgroup sandboxes using transient slices for resources that are supported by that init system.Depending on the configuration of the associated container runtime, operators may have to choose a particular cgroup driver to ensure proper system behavior. For example, if operators use the systemd cgroup driver provided by the containerd runtime, the kubelet must be configured to use the systemd cgroup driver.Kube ReservedKubeletConfiguration Setting: kubeReserved: {}. Example value {cpu: 100m, memory: 100Mi, ephemeral-storage: 1Gi, pid=1000}KubeletConfiguration Setting: kubeReservedCgroup: ""kubeReserved is meant to capture resource reservation for kubernetes system


Question: What is Reserve Compute Resources for System Daemons?

Answer: K u b e r n e t e s   n o d e s   c a n   b e   s c h e d u l e d   t o   C a p a c i t y .   P o d s   c a n   c o n s u m e   a l l   t h e   a v a i l a b l e   c a p a c i t y   o n   a   n o d e   b y   d e f a u l t .   T h i s   i s   a n   i s s u e   b e c a u s e   n o d e s   t y p i c a l l y   r u n   q u i t e   a   f e w   s y s t e m   d a e m o n s   t h a t   p o w e r   t h e   O S   a n d   K u b e r n e t e s   i t s e l f .   U n l e s s   r e s o u r c e s   a r e   s e t   a s i d e   f o r   t h e s e   s y s t e m   d a e m o n s ,   p o d s   a n d   s y s t e m   d a e m o n s   c o m p e t e   f o r   r e s o u r c e s   a n d   l e a d   t o   r e s o u r c e   s t a r v a t i o n   i s s u e s   o n   t h e   n o d e .   T h e   k u b e l e t   e x p o s e s   a   f e a t u r e   n a m e d   ' N o d e   A l l o c a t a b l e '   t h a t   h e l p s   t o   r e s e r v e   c o m p u t e   r e s o u r c e s   f o r   s y s t e m   d a e m o n s .   K u b e r n e t e s   r e c o m m e n d s   c l u s t e r   a d m i n i s t r a t o r s   t o   c o n f i g u r e   ' N o d e   A l l o c a t a b l e '   b a s e d   o n   t h e i r   w o r k l o a d   d e n s i t y   o n   e a c h   n o d e .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   Y o u   c a n   c o n f i g u r e   b e l o w   k u b e l e t   c o n f i g u r a t i o n   s e t t i n g s   u s i n g   t h e   k u b e l e t   c o n f i g u r a t i o n   f i l e .


Question: What is Node Allocatable?

Answer: ' A l l o c a t a b l e '   o n   a   K u b e r n e t e s   n o d e   i s   d e f i n e d   a s   t h e   a m o u n t   o f   c o m p u t e   r e s o u r c e s   t h a t   a r e   a v a i l a b l e   f o r   p o d s .   T h e   s c h e d u l e r   d o e s   n o t   o v e r - s u b s c r i b e   ' A l l o c a t a b l e ' .   ' C P U ' ,   ' m e m o r y '   a n d   ' e p h e m e r a l - s t o r a g e '   a r e   s u p p o r t e d   a s   o f   n o w .   N o d e   A l l o c a t a b l e   i s   e x p o s e d   a s   p a r t   o f   v 1 . N o d e   o b j e c t   i n   t h e   A P I   a n d   a s   p a r t   o f   k u b e c t l   d e s c r i b e   n o d e   i n   t h e   C L I .   R e s o u r c e s   c a n   b e   r e s e r v e d   f o r   t w o   c a t e g o r i e s   o f   s y s t e m   d a e m o n s   i n   t h e   k u b e l e t .


Question: What is Enabling QoS and Pod level cgroups?

Answer: T o   p r o p e r l y   e n f o r c e   n o d e   a l l o c a t a b l e   c o n s t r a i n t s   o n   t h e   n o d e ,   y o u   m u s t   e n a b l e   t h e   n e w   c g r o u p   h i e r a r c h y   v i a   t h e   c g r o u p s P e r Q O S   s e t t i n g .   T h i s   s e t t i n g   i s   e n a b l e d   b y   d e f a u l t .   W h e n   e n a b l e d ,   t h e   k u b e l e t   w i l l   p a r e n t   a l l   e n d - u s e r   p o d s   u n d e r   a   c g r o u p   h i e r a r c h y   m a n a g e d   b y   t h e   k u b e l e t .


Question: What is Configuring a cgroup driver?

Answer: T h e   k u b e l e t   s u p p o r t s   m a n i p u l a t i o n   o f   t h e   c g r o u p   h i e r a r c h y   o n   t h e   h o s t   u s i n g   a   c g r o u p   d r i v e r .   T h e   d r i v e r   i s   c o n f i g u r e d   v i a   t h e   c g r o u p D r i v e r   s e t t i n g .   T h e   s u p p o r t e d   v a l u e s   a r e   t h e   f o l l o w i n g :   c g r o u p f s   i s   t h e   d e f a u l t   d r i v e r   t h a t   p e r f o r m s   d i r e c t   m a n i p u l a t i o n   o f   t h e   c g r o u p   f i l e s y s t e m   o n   t h e   h o s t   i n   o r d e r   t o   m a n a g e   c g r o u p   s a n d b o x e s . s y s t e m d   i s   a n   a l t e r n a t i v e   d r i v e r   t h a t   m a n a g e s   c g r o u p   s a n d b o x e s   u s i n g   t r a n s i e n t   s l i c e s   f o r   r e s o u r c e s   t h a t   a r e   s u p p o r t e d   b y   t h a t   i n i t   s y s t e m .   D e p e n d i n g   o n   t h e   c o n f i g u r a t i o n   o f   t h e   a s s o c i a t e d   c o n t a i n e r   r u n t i m e ,   o p e r a t o r s   m a y   h a v e   t o   c h o o s e   a   p a r t i c u l a r   c g r o u p   d r i v e r   t o   e n s u r e   p r o p e r   s y s t e m   b e h a v i o r .   F o r   e x a m p l e ,   i f   o p e r a t o r s   u s e   t h e   s y s t e m d   c g r o u p   d r i v e r   p r o v i d e d   b y   t h e   c o n t a i n e r d   r u n t i m e ,   t h e   k u b e l e t   m u s t   b e   c o n f i g u r e d   t o   u s e   t h e   s y s t e m d   c g r o u p   d r i v e r .


Question: What is Kube Reserved?

Answer: K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   k u b e R e s e r v e d :   { } .   E x a m p l e   v a l u e   { c p u :   1 0 0 m ,   m e m o r y :   1 0 0 M i ,   e p h e m e r a l - s t o r a g e :   1 G i ,   p i d = 1 0 0 0 } K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   k u b e R e s e r v e d C g r o u p :   " "   k u b e R e s e r v e d   i s   m e a n t   t o   c a p t u r e   r e s o u r c e   r e s e r v a t i o n   f o r   k u b e r n e t e s   s y s t e m   d a e m o n s   l i k e   t h e   k u b e l e t ,   c o n t a i n e r   r u n t i m e ,   e t c .   I t   i s   n o t   m e a n t   t o   r e s e r v e   r e s o u r c e s   f o r   s y s t e m   d a e m o n s   t h a t   a r e   r u n   a s   p o d s .   k u b e R e s e r v e d   i s   t y p i c a l l y   a   f u n c t i o n   o f   p o d   d e n s i t y   o n   t h e   n o d e s .   I n   a d d i t i o n   t o   c p u ,   m e m o r y ,   a n d   e p h e m e r a l - s t o r a g e ,   p i d   m a y   b e   s p e c i f i e d   t o   r e s e r v e   t h e   s p e c i f i e d   n u m b e r   o f   p r o c e s s   I D s   f o r   k u b e r n e t e s   s y s t e m   d a e m o n s .   T o   o p t i o n a l l y   e n f o r c e   k u b e R e s e r v e d   o n   k u b e r n e t e s   s y s t e m   d a e m o n s ,   s p e c i f y   t h e   p a r e n t   c o n t r o l   g r o u p   f o r   k u b e   d a e m o n s   a s   t h e   v a l u e   f o r   k u b e R e s e r v e d C g r o u p   s e t t i n g ,   a n d   a d d   k u b e - r e s e r v e d   t o   e n f o r c e N o d e A l l o c a t a b l e .   I t   i s   r e c o m m e n d e d   t h a t   t h e   k u b e r n e t e s   s y s t e m   d a e m o n s   a r e   p l a c e d   u n d e r   a   t o p   l e v e l   c o n t r o l   g r o u p   ( r u n t i m e . s l i c e   o n   s y s t e m d   m a c h i n e s   f o r   e x a m p l e ) .   E a c h   s y s t e m   d a e m o n   s h o u l d   i d e a l l y   r u n   w i t h i n   i t s   o w


Question: What is System Reserved?

Answer: K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   s y s t e m R e s e r v e d :   { } .   E x a m p l e   v a l u e   { c p u :   1 0 0 m ,   m e m o r y :   1 0 0 M i ,   e p h e m e r a l - s t o r a g e :   1 G i ,   p i d = 1 0 0 0 } K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   s y s t e m R e s e r v e d C g r o u p :   " "   s y s t e m R e s e r v e d   i s   m e a n t   t o   c a p t u r e   r e s o u r c e   r e s e r v a t i o n   f o r   O S   s y s t e m   d a e m o n s   l i k e   s s h d ,   u d e v ,   e t c .   s y s t e m R e s e r v e d   s h o u l d   r e s e r v e   m e m o r y   f o r   t h e   k e r n e l   t o o   s i n c e   k e r n e l   m e m o r y   i s   n o t   a c c o u n t e d   t o   p o d s   i n   K u b e r n e t e s   a t   t h i s   t i m e .   R e s e r v i n g   r e s o u r c e s   f o r   u s e r   l o g i n   s e s s i o n s   i s   a l s o   r e c o m m e n d e d   ( u s e r . s l i c e   i n   s y s t e m d   w o r l d ) .   I n   a d d i t i o n   t o   c p u ,   m e m o r y ,   a n d   e p h e m e r a l - s t o r a g e ,   p i d   m a y   b e   s p e c i f i e d   t o   r e s e r v e   t h e   s p e c i f i e d   n u m b e r   o f   p r o c e s s   I D s   f o r   O S   s y s t e m   d a e m o n s .   T o   o p t i o n a l l y   e n f o r c e   s y s t e m R e s e r v e d   o n   s y s t e m   d a e m o n s ,   s p e c i f y   t h e   p a r e n t   c o n t r o l   g r o u p   f o r   O S   s y s t e m   d a e m o n s   a s   t h e   v a l u e   f o r   s y s t e m R e s e r v e d C g r o u p   s e t t i n g ,   a n d   a d d   s y s t e m - r e s e r v e d   t o   e n f o r c e N o d e A l l o c a t a b l e .   I t   i s   r e c o m m e n d e d   t h a t   t h e   O S   s y s t e m   d a e m o n s   a r e   p l a c e d   u n d e r   a   t o p   l e v e l   c o n t r o l   g r o u p   ( s y s t e m . s l i c e   o n   s y s t e m d   m a c h i n e s   f o r   e x a m p l e ) .   N o t e   t h a t


Question: What is Explicitly Reserved CPU List?

Answer: K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   r e s e r v e d S y s t e m C P U s : .   E x a m p l e   v a l u e   0 - 3   r e s e r v e d S y s t e m C P U s   i s   m e a n t   t o   d e f i n e   a n   e x p l i c i t   C P U   s e t   f o r   O S   s y s t e m   d a e m o n s   a n d   k u b e r n e t e s   s y s t e m   d a e m o n s .   r e s e r v e d S y s t e m C P U s   i s   f o r   s y s t e m s   t h a t   d o   n o t   i n t e n d   t o   d e f i n e   s e p a r a t e   t o p   l e v e l   c g r o u p s   f o r   O S   s y s t e m   d a e m o n s   a n d   k u b e r n e t e s   s y s t e m   d a e m o n s   w i t h   r e g a r d   t o   c p u s e t   r e s o u r c e .   I f   t h e   K u b e l e t   d o e s   n o t   h a v e   k u b e R e s e r v e d C g r o u p   a n d   s y s t e m R e s e r v e d C g r o u p ,   t h e   e x p l i c i t   c p u s e t   p r o v i d e d   b y   r e s e r v e d S y s t e m C P U s   w i l l   t a k e   p r e c e d e n c e   o v e r   t h e   C P U s   d e f i n e d   b y   k u b e R e s e r v e d C g r o u p   a n d   s y s t e m R e s e r v e d C g r o u p   o p t i o n s .   T h i s   o p t i o n   i s   s p e c i f i c a l l y   d e s i g n e d   f o r   T e l c o / N F V   u s e   c a s e s   w h e r e   u n c o n t r o l l e d   i n t e r r u p t s / t i m e r s   m a y   i m p a c t   t h e   w o r k l o a d   p e r f o r m a n c e .   y o u   c a n   u s e   t h i s   o p t i o n   t o   d e f i n e   t h e   e x p l i c i t   c p u s e t   f o r   t h e   s y s t e m / k u b e r n e t e s   d a e m o n s   a s   w e l l   a s   t h e   i n t e r r u p t s / t i m e r s ,   s o   t h e   r e s t   C P U s   o n   t h e   s y s t e m   c a n   b e   u s e d   e x c l u s i v e l y   f o r   w o r k l o a d s ,   w i t h   l e s s   i m p a c t   f r o m   u n c o n t r o l l e d   i n t e r r u p t s / t i m e r s .   T o   m o v e   t h e   s y s t e m   d a e m o n ,   k u b e r n e t e s   d a e


Question: What is Eviction Thresholds?

Answer: K u b e l e t C o n f i g u r a t i o n   S e t t i n g :   e v i c t i o n H a r d :   { m e m o r y . a v a i l a b l e :   " 1 0 0 M i " ,   n o d e f s . a v a i l a b l e :   " 1 0 % " ,   n o d e f s . i n o d e s F r e e :   " 5 % " ,   i m a g e f s . a v a i l a b l e :   " 1 5 % " } .   E x a m p l e   v a l u e :   { m e m o r y . a v a i l a b l e :   " < 5 0 0 M i " }   M e m o r y   p r e s s u r e   a t   t h e   n o d e   l e v e l   l e a d s   t o   S y s t e m   O O M s   w h i c h   a f f e c t s   t h e   e n t i r e   n o d e   a n d   a l l   p o d s   r u n n i n g   o n   i t .   N o d e s   c a n   g o   o f f l i n e   t e m p o r a r i l y   u n t i l   m e m o r y   h a s   b e e n   r e c l a i m e d .   T o   a v o i d   ( o r   r e d u c e   t h e   p r o b a b i l i t y   o f )   s y s t e m   O O M s   k u b e l e t   p r o v i d e s   o u t   o f   r e s o u r c e   m a n a g e m e n t .   E v i c t i o n s   a r e   s u p p o r t e d   f o r   m e m o r y   a n d   e p h e m e r a l - s t o r a g e   o n l y .   B y   r e s e r v i n g   s o m e   m e m o r y   v i a   e v i c t i o n H a r d   s e t t i n g ,   t h e   k u b e l e t   a t t e m p t s   t o   e v i c t   p o d s   w h e n e v e r   m e m o r y   a v a i l a b i l i t y   o n   t h e   n o d e   d r o p s   b e l o w   t h e   r e s e r v e d   v a l u e .   H y p o t h e t i c a l l y ,   i f   s y s t e m   d a e m o n s   d i d   n o t   e x i s t   o n   a   n o d e ,   p o d s   c a n n o t   u s e   m o r e   t h a n   c a p a c i t y   -   e v i c t i o n - h a r d .   F o r   t h i s   r e a s o n ,   r e s o u r c e s   r e s e r v e d   f o r   e v i c t i o n s   a r e   n o t   a v a i l a b l e   f o r   p o d s .


Question: What is Enforcing Node Allocatable?

Answer: K u b e l e t C o n f i g u r a t i o n   s e t t i n g :   e n f o r c e N o d e A l l o c a t a b l e :   [ p o d s ] .   E x a m p l e   v a l u e :   [ p o d s , s y s t e m - r e s e r v e d , k u b e - r e s e r v e d ]   T h e   s c h e d u l e r   t r e a t s   ' A l l o c a t a b l e '   a s   t h e   a v a i l a b l e   c a p a c i t y   f o r   p o d s .   k u b e l e t   e n f o r c e   ' A l l o c a t a b l e '   a c r o s s   p o d s   b y   d e f a u l t .   E n f o r c e m e n t   i s   p e r f o r m e d   b y   e v i c t i n g   p o d s   w h e n e v e r   t h e   o v e r a l l   u s a g e   a c r o s s   a l l   p o d s   e x c e e d s   ' A l l o c a t a b l e ' .   M o r e   d e t a i l s   o n   e v i c t i o n   p o l i c y   c a n   b e   f o u n d   o n   t h e   n o d e   p r e s s u r e   e v i c t i o n   p a g e .   T h i s   e n f o r c e m e n t   i s   c o n t r o l l e d   b y   s p e c i f y i n g   p o d s   v a l u e   t o   t h e   K u b e l e t C o n f i g u r a t i o n   s e t t i n g   e n f o r c e N o d e A l l o c a t a b l e .   O p t i o n a l l y ,   k u b e l e t   c a n   b e   m a d e   t o   e n f o r c e   k u b e R e s e r v e d   a n d   s y s t e m R e s e r v e d   b y   s p e c i f y i n g   k u b e - r e s e r v e d   &   s y s t e m - r e s e r v e d   v a l u e s   i n   t h e   s a m e   s e t t i n g .   N o t e   t h a t   t o   e n f o r c e   k u b e R e s e r v e d   o r   s y s t e m R e s e r v e d ,   k u b e R e s e r v e d C g r o u p   o r   s y s t e m R e s e r v e d C g r o u p   n e e d s   t o   b e   s p e c i f i e d   r e s p e c t i v e l y .


Question: What is General Guidelines?

Answer: S y s t e m   d a e m o n s   a r e   e x p e c t e d   t o   b e   t r e a t e d   s i m i l a r   t o   G u a r a n t e e d   p o d s .   S y s t e m   d a e m o n s   c a n   b u r s t   w i t h i n   t h e i r   b o u n d i n g   c o n t r o l   g r o u p s   a n d   t h i s   b e h a v i o r   n e e d s   t o   b e   m a n a g e d   a s   p a r t   o f   k u b e r n e t e s   d e p l o y m e n t s .   F o r   e x a m p l e ,   k u b e l e t   s h o u l d   h a v e   i t s   o w n   c o n t r o l   g r o u p   a n d   s h a r e   k u b e R e s e r v e d   r e s o u r c e s   w i t h   t h e   c o n t a i n e r   r u n t i m e .   H o w e v e r ,   K u b e l e t   c a n n o t   b u r s t   a n d   u s e   u p   a l l   a v a i l a b l e   N o d e   r e s o u r c e s   i f   k u b e R e s e r v e d   i s   e n f o r c e d .   B e   e x t r a   c a r e f u l   w h i l e   e n f o r c i n g   s y s t e m R e s e r v e d   r e s e r v a t i o n   s i n c e   i t   c a n   l e a d   t o   c r i t i c a l   s y s t e m   s e r v i c e s   b e i n g   C P U   s t a r v e d ,   O O M   k i l l e d ,   o r   u n a b l e   t o   f o r k   o n   t h e   n o d e .   T h e   r e c o m m e n d a t i o n   i s   t o   e n f o r c e   s y s t e m R e s e r v e d   o n l y   i f   a   u s e r   h a s   p r o f i l e d   t h e i r   n o d e s   e x h a u s t i v e l y   t o   c o m e   u p   w i t h   p r e c i s e   e s t i m a t e s   a n d   i s   c o n f i d e n t   i n   t h e i r   a b i l i t y   t o   r e c o v e r   i f   a n y   p r o c e s s   i n   t h a t   g r o u p   i s   o o m - k i l l e d .   T o   b e g i n   w i t h   e n f o r c e   ' A l l o c a t a b l e '   o n   p o d s . O n c e   a d e q u a t e   m o n i t o r i n g   a n d   a l e r t i n g   i s   i n   p l a c e   t o   t r a c k   k u b e   s y s t e m   d a e m o n s ,   a t t e m p t   t o   e n f o r c e   k u b e R e s e r v e d   b a s e d   o n   u s a g e   h e u r i s t i c s . I f   a b s


Question: What is Example Scenario?

Answer: H e r e   i s   a n   e x a m p l e   t o   i l l u s t r a t e   N o d e   A l l o c a t a b l e   c o m p u t a t i o n :   N o d e   h a s   3 2 G i   o f   m e m o r y ,   1 6   C P U s   a n d   1 0 0 G i   o f   S t o r a g e k u b e R e s e r v e d   i s   s e t   t o   { c p u :   1 0 0 0 m ,   m e m o r y :   2 G i ,   e p h e m e r a l - s t o r a g e :   1 G i } s y s t e m R e s e r v e d   i s   s e t   t o   { c p u :   5 0 0 m ,   m e m o r y :   1 G i ,   e p h e m e r a l - s t o r a g e :   1 G i } e v i c t i o n H a r d   i s   s e t   t o   { m e m o r y . a v a i l a b l e :   " < 5 0 0 M i " ,   n o d e f s . a v a i l a b l e :   " < 1 0 % " }   U n d e r   t h i s   s c e n a r i o ,   ' A l l o c a t a b l e '   w i l l   b e   1 4 . 5   C P U s ,   2 8 . 5 G i   o f   m e m o r y   a n d   8 8 G i   o f   l o c a l   s t o r a g e .   S c h e d u l e r   e n s u r e s   t h a t   t h e   t o t a l   m e m o r y   r e q u e s t s   a c r o s s   a l l   p o d s   o n   t h i s   n o d e   d o e s   n o t   e x c e e d   2 8 . 5 G i   a n d   s t o r a g e   d o e s n ' t   e x c e e d   8 8 G i .   K u b e l e t   e v i c t s   p o d s   w h e n e v e r   t h e   o v e r a l l   m e m o r y   u s a g e   a c r o s s   p o d s   e x c e e d s   2 8 . 5 G i ,   o r   i f   o v e r a l l   d i s k   u s a g e   e x c e e d s   8 8 G i .   I f   a l l   p r o c e s s e s   o n   t h e   n o d e   c o n s u m e   a s   m u c h   C P U   a s   t h e y   c a n ,   p o d s   t o g e t h e r   c a n n o t   c o n s u m e   m o r e   t h a n   1 4 . 5   C P U s .   I f   k u b e R e s e r v e d   a n d / o r   s y s t e m R e s e r v e d   i s   n o t   e n f o r c e d   a n d   s y s t e m   d a e m o n s   e x c e e d   t h e i r   r e s e r v a t i o n ,   k u b e l e t   e v i c t s   p o d s   w h e n e v e r   t h e   o v e r a l l   n o d e   m e m o r y   u s a g e   i s   h i g h e r   t h a n   3 1 . 5 G i   o r   s t o r a g e   i s   g r


Question: What is kubeadm join?

Answer: kubeadm joinThis command initializes a new Kubernetes node and joins it to the existing cluster.Run this on any machine you wish to join an existing clusterSynopsisWhen joining a kubeadm initialized cluster, we need to establish bidirectional trust. This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).There are 2 main schemes for discovery. The first is to use a shared token along with the IP address of the API server. The second is to provide a file - a subset of the standard kubeconfig file. The discovery/kubeconfig file supports token, client-go authentication plugins ("exec"), "tokenFile", and "authProvider". This file can be a local file or downloaded via an HTTPS URL. The forms are kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443, kubeadm join --discovery-file path/to/file.conf, or kubeadm join --discovery-file https://url/file.conf. Only one form can be used. If the discovery information is loaded from a URL, HTTPS must be used. Also, in that case the host installed CA bundle is used to verify the connection.If you use a shared token for discovery, you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane. The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256". The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469). This value is available in the output of "kubeadm init" or can be calculated using standard tools. The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.If you cannot know the CA public key hash ahead of time, you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification. This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.The TLS bootstrap mechanism is also driven via a shared token. This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created key pair. By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests. This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.The "join [api-server-endpoint]" command executes the following phases:preflight Run join pre-flight checks control-plane-prepare Prepare the machine for serving a control plane /download-certs Download certificates shared among control-plane nodes from the kubeadm-certs Secret /certs Generate the certificates for the new control plane components /kubeconfig Generate the kubeconfig for the new c


Question: How does kubeadm join work?

Answer: kubeadm joinThis command initializes a new Kubernetes node and joins it to the existing cluster.Run this on any machine you wish to join an existing clusterSynopsisWhen joining a kubeadm initialized cluster, we need to establish bidirectional trust. This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).There are 2 main schemes for discovery. The first is to use a shared token along with the IP address of the API server. The second is to provide a file - a subset of the standard kubeconfig file. The discovery/kubeconfig file supports token, client-go authentication plugins ("exec"), "tokenFile", and "authProvider". This file can be a local file or downloaded via an HTTPS URL. The forms are kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443, kubeadm join --discovery-file path/to/file.conf, or kubeadm join --discovery-file https://url/file.conf. Only one form can be used. If the discovery information is loaded from a URL, HTTPS must be used. Also, in that case the host installed CA bundle is used to verify the connection.If you use a shared token for discovery, you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane. The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256". The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469). This value is available in the output of "kubeadm init" or can be calculated using standard tools. The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.If you cannot know the CA public key hash ahead of time, you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification. This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.The TLS bootstrap mechanism is also driven via a shared token. This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created key pair. By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests. This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.The "join [api-server-endpoint]" command executes the following phases:preflight Run join pre-flight checks control-plane-prepare Prepare the machine for serving a control plane /download-certs Download certificates shared among control-plane nodes from the kubeadm-certs Secret /certs Generate the certificates for the new control plane components /kubeconfig Generate the kubeconfig for the new c


Question: When would you use kubeadm join?

Answer: kubeadm joinThis command initializes a new Kubernetes node and joins it to the existing cluster.Run this on any machine you wish to join an existing clusterSynopsisWhen joining a kubeadm initialized cluster, we need to establish bidirectional trust. This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).There are 2 main schemes for discovery. The first is to use a shared token along with the IP address of the API server. The second is to provide a file - a subset of the standard kubeconfig file. The discovery/kubeconfig file supports token, client-go authentication plugins ("exec"), "tokenFile", and "authProvider". This file can be a local file or downloaded via an HTTPS URL. The forms are kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443, kubeadm join --discovery-file path/to/file.conf, or kubeadm join --discovery-file https://url/file.conf. Only one form can be used. If the discovery information is loaded from a URL, HTTPS must be used. Also, in that case the host installed CA bundle is used to verify the connection.If you use a shared token for discovery, you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane. The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256". The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469). This value is available in the output of "kubeadm init" or can be calculated using standard tools. The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.If you cannot know the CA public key hash ahead of time, you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification. This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.The TLS bootstrap mechanism is also driven via a shared token. This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created key pair. By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests. This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.The "join [api-server-endpoint]" command executes the following phases:preflight Run join pre-flight checks control-plane-prepare Prepare the machine for serving a control plane /download-certs Download certificates shared among control-plane nodes from the kubeadm-certs Secret /certs Generate the certificates for the new control plane components /kubeconfig Generate the kubeconfig for the new c


Question: What are the benefits of kubeadm join?

Answer: kubeadm joinThis command initializes a new Kubernetes node and joins it to the existing cluster.Run this on any machine you wish to join an existing clusterSynopsisWhen joining a kubeadm initialized cluster, we need to establish bidirectional trust. This is split into discovery (having the Node trust the Kubernetes Control Plane) and TLS bootstrap (having the Kubernetes Control Plane trust the Node).There are 2 main schemes for discovery. The first is to use a shared token along with the IP address of the API server. The second is to provide a file - a subset of the standard kubeconfig file. The discovery/kubeconfig file supports token, client-go authentication plugins ("exec"), "tokenFile", and "authProvider". This file can be a local file or downloaded via an HTTPS URL. The forms are kubeadm join --discovery-token abcdef.1234567890abcdef 1.2.3.4:6443, kubeadm join --discovery-file path/to/file.conf, or kubeadm join --discovery-file https://url/file.conf. Only one form can be used. If the discovery information is loaded from a URL, HTTPS must be used. Also, in that case the host installed CA bundle is used to verify the connection.If you use a shared token for discovery, you should also pass the --discovery-token-ca-cert-hash flag to validate the public key of the root certificate authority (CA) presented by the Kubernetes Control Plane. The value of this flag is specified as "<hash-type>:<hex-encoded-value>", where the supported hash type is "sha256". The hash is calculated over the bytes of the Subject Public Key Info (SPKI) object (as in RFC7469). This value is available in the output of "kubeadm init" or can be calculated using standard tools. The --discovery-token-ca-cert-hash flag may be repeated multiple times to allow more than one public key.If you cannot know the CA public key hash ahead of time, you can pass the --discovery-token-unsafe-skip-ca-verification flag to disable this verification. This weakens the kubeadm security model since other nodes can potentially impersonate the Kubernetes Control Plane.The TLS bootstrap mechanism is also driven via a shared token. This is used to temporarily authenticate with the Kubernetes Control Plane to submit a certificate signing request (CSR) for a locally created key pair. By default, kubeadm will set up the Kubernetes Control Plane to automatically approve these signing requests. This token is passed in with the --tls-bootstrap-token abcdef.1234567890abcdef flag.Often times the same token is used for both parts. In this case, the --token flag can be used instead of specifying each token individually.The "join [api-server-endpoint]" command executes the following phases:preflight Run join pre-flight checks control-plane-prepare Prepare the machine for serving a control plane /download-certs Download certificates shared among control-plane nodes from the kubeadm-certs Secret /certs Generate the certificates for the new control plane components /kubeconfig Generate the kubeconfig for the new c


Question: What is kubeadm join?

Answer: T h i s   c o m m a n d   i n i t i a l i z e s   a   n e w   K u b e r n e t e s   n o d e   a n d   j o i n s   i t   t o   t h e   e x i s t i n g   c l u s t e r .   R u n   t h i s   o n   a n y   m a c h i n e   y o u   w i s h   t o   j o i n   a n   e x i s t i n g   c l u s t e r


Question: What is Synopsis?

Answer: W h e n   j o i n i n g   a   k u b e a d m   i n i t i a l i z e d   c l u s t e r ,   w e   n e e d   t o   e s t a b l i s h   b i d i r e c t i o n a l   t r u s t .   T h i s   i s   s p l i t   i n t o   d i s c o v e r y   ( h a v i n g   t h e   N o d e   t r u s t   t h e   K u b e r n e t e s   C o n t r o l   P l a n e )   a n d   T L S   b o o t s t r a p   ( h a v i n g   t h e   K u b e r n e t e s   C o n t r o l   P l a n e   t r u s t   t h e   N o d e ) .   T h e r e   a r e   2   m a i n   s c h e m e s   f o r   d i s c o v e r y .   T h e   f i r s t   i s   t o   u s e   a   s h a r e d   t o k e n   a l o n g   w i t h   t h e   I P   a d d r e s s   o f   t h e   A P I   s e r v e r .   T h e   s e c o n d   i s   t o   p r o v i d e   a   f i l e   -   a   s u b s e t   o f   t h e   s t a n d a r d   k u b e c o n f i g   f i l e .   T h e   d i s c o v e r y / k u b e c o n f i g   f i l e   s u p p o r t s   t o k e n ,   c l i e n t - g o   a u t h e n t i c a t i o n   p l u g i n s   ( " e x e c " ) ,   " t o k e n F i l e " ,   a n d   " a u t h P r o v i d e r " .   T h i s   f i l e   c a n   b e   a   l o c a l   f i l e   o r   d o w n l o a d e d   v i a   a n   H T T P S   U R L .   T h e   f o r m s   a r e   k u b e a d m   j o i n   - - d i s c o v e r y - t o k e n   a b c d e f . 1 2 3 4 5 6 7 8 9 0 a b c d e f   1 . 2 . 3 . 4 : 6 4 4 3 ,   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   p a t h / t o / f i l e . c o n f ,   o r   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   h t t p s : / / u r l / f i l e . c o n f .   O n l y   o n e   f o r m   c a n   b e   u s e d .   I f   t h e   d i s c o v e r y   i n f o r m a t i o n   i s   l o a d e d   f r o m   a   U R L ,   H T T P S   m u s t   b e   u s e d .   A l s o ,   i n   t h a t   c a s e   t h e   h o s t   i n s t a l l e d   C A   b u n d l e   i s   u s e d   t o   v e r i f y   t h e   c o n n e c t i o n .   I f   y o u   u s e   a


Question: What is Options?

Answer: I f   t h e   n o d e   s h o u l d   h o s t   a   n e w   c o n t r o l   p l a n e   i n s t a n c e ,   t h e   I P   a d d r e s s   t h e   A P I   S e r v e r   w i l l   a d v e r t i s e   i t ' s   l i s t e n i n g   o n .   I f   n o t   s e t   t h e   d e f a u l t   n e t w o r k   i n t e r f a c e   w i l l   b e   u s e d .   I f   t h e   n o d e   s h o u l d   h o s t   a   n e w   c o n t r o l   p l a n e   i n s t a n c e ,   t h e   p o r t   f o r   t h e   A P I   S e r v e r   t o   b i n d   t o .   U s e   t h i s   k e y   t o   d e c r y p t   t h e   c e r t i f i c a t e   s e c r e t s   u p l o a d e d   b y   i n i t .   T h e   c e r t i f i c a t e   k e y   i s   a   h e x   e n c o d e d   s t r i n g   t h a t   i s   a n   A E S   k e y   o f   s i z e   3 2   b y t e s .   P a t h   t o   a   k u b e a d m   c o n f i g u r a t i o n   f i l e .   C r e a t e   a   n e w   c o n t r o l   p l a n e   i n s t a n c e   o n   t h i s   n o d e   P a t h   t o   t h e   C R I   s o c k e t   t o   c o n n e c t .   I f   e m p t y   k u b e a d m   w i l l   t r y   t o   a u t o - d e t e c t   t h i s   v a l u e ;   u s e   t h i s   o p t i o n   o n l y   i f   y o u   h a v e   m o r e   t h a n   o n e   C R I   i n s t a l l e d   o r   i f   y o u   h a v e   n o n - s t a n d a r d   C R I   s o c k e t .   F o r   f i l e - b a s e d   d i s c o v e r y ,   a   f i l e   o r   U R L   f r o m   w h i c h   t o   l o a d   c l u s t e r   i n f o r m a t i o n .   F o r   t o k e n - b a s e d   d i s c o v e r y ,   t h e   t o k e n   u s e d   t o   v a l i d a t e   c l u s t e r   i n f o r m a t i o n   f e t c h e d   f r o m   t h e   A P I   s e r v e r .   F o r   t o k e n - b a s e d   d i s c o v e r y ,   v a l i d a t e   t h a t   t h e   r o o t   C A   p u b l i c   k e y   m a t c h e s   t h i s   h a s h   ( f o r m a t :   " < t y p e > : < v a l u e > " ) .   F o r   t o k e n - b a s e d   d


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is The join workflow?

Answer: k u b e a d m   j o i n   b o o t s t r a p s   a   K u b e r n e t e s   w o r k e r   n o d e   o r   a   c o n t r o l - p l a n e   n o d e   a n d   a d d s   i t   t o   t h e   c l u s t e r .   T h i s   a c t i o n   c o n s i s t s   o f   t h e   f o l l o w i n g   s t e p s   f o r   w o r k e r   n o d e s :   k u b e a d m   d o w n l o a d s   n e c e s s a r y   c l u s t e r   i n f o r m a t i o n   f r o m   t h e   A P I   s e r v e r .   B y   d e f a u l t ,   i t   u s e s   t h e   b o o t s t r a p   t o k e n   a n d   t h e   C A   k e y   h a s h   t o   v e r i f y   t h e   a u t h e n t i c i t y   o f   t h a t   d a t a .   T h e   r o o t   C A   c a n   a l s o   b e   d i s c o v e r e d   d i r e c t l y   v i a   a   f i l e   o r   U R L . O n c e   t h e   c l u s t e r   i n f o r m a t i o n   i s   k n o w n ,   k u b e l e t   c a n   s t a r t   t h e   T L S   b o o t s t r a p p i n g   p r o c e s s . T h e   T L S   b o o t s t r a p   u s e s   t h e   s h a r e d   t o k e n   t o   t e m p o r a r i l y   a u t h e n t i c a t e   w i t h   t h e   K u b e r n e t e s   A P I   s e r v e r   t o   s u b m i t   a   c e r t i f i c a t e   s i g n i n g   r e q u e s t   ( C S R ) ;   b y   d e f a u l t   t h e   c o n t r o l   p l a n e   s i g n s   t h i s   C S R   r e q u e s t   a u t o m a t i c a l l y . F i n a l l y ,   k u b e a d m   c o n f i g u r e s   t h e   l o c a l   k u b e l e t   t o   c o n n e c t   t o   t h e   A P I   s e r v e r   w i t h   t h e   d e f i n i t i v e   i d e n t i t y   a s s i g n e d   t o   t h e   n o d e .   k u b e a d m   d o w n l o a d s   n e c e s s a r y   c l u s t e r   i n f o r m a t i o n   f r o m   t h e   A P I   s e r v e r .   B y   d e f a u l t ,   i t   u s e s   t h e   b o o t s t r a p   t o k e n   a n d   t h e   C A   k e y   h a s h   t o   v e r i f y   t h e   a u t h e n t i c i t y   o f   t h a t   d a t a .   T h e   r o o t   C


Question: What is Using join phases with kubeadm?

Answer: K u b e a d m   a l l o w s   y o u   j o i n   a   n o d e   t o   t h e   c l u s t e r   i n   p h a s e s   u s i n g   k u b e a d m   j o i n   p h a s e .   T o   v i e w   t h e   o r d e r e d   l i s t   o f   p h a s e s   a n d   s u b - p h a s e s   y o u   c a n   c a l l   k u b e a d m   j o i n   - - h e l p .   T h e   l i s t   w i l l   b e   l o c a t e d   a t   t h e   t o p   o f   t h e   h e l p   s c r e e n   a n d   e a c h   p h a s e   w i l l   h a v e   a   d e s c r i p t i o n   n e x t   t o   i t .   N o t e   t h a t   b y   c a l l i n g   k u b e a d m   j o i n   a l l   o f   t h e   p h a s e s   a n d   s u b - p h a s e s   w i l l   b e   e x e c u t e d   i n   t h i s   e x a c t   o r d e r .   S o m e   p h a s e s   h a v e   u n i q u e   f l a g s ,   s o   i f   y o u   w a n t   t o   h a v e   a   l o o k   a t   t h e   l i s t   o f   a v a i l a b l e   o p t i o n s   a d d   - - h e l p ,   f o r   e x a m p l e :   k u b e a d m   j o i n   p h a s e   k u b e l e t - s t a r t   - - h e l p   S i m i l a r   t o   t h e   k u b e a d m   i n i t   p h a s e   c o m m a n d ,   k u b e a d m   j o i n   p h a s e   a l l o w s   y o u   t o   s k i p   a   l i s t   o f   p h a s e s   u s i n g   t h e   - - s k i p - p h a s e s   f l a g .   F o r   e x a m p l e :   s u d o   k u b e a d m   j o i n   - - s k i p - p h a s e s = p r e f l i g h t   - - c o n f i g = c o n f i g . y a m l   A l t e r n a t i v e l y ,   y o u   c a n   u s e   t h e   s k i p P h a s e s   f i e l d   i n   J o i n C o n f i g u r a t i o n .


Question: What is Discovering what cluster CA to trust?

Answer: T h e   k u b e a d m   d i s c o v e r y   h a s   s e v e r a l   o p t i o n s ,   e a c h   w i t h   s e c u r i t y   t r a d e o f f s .   T h e   r i g h t   m e t h o d   f o r   y o u r   e n v i r o n m e n t   d e p e n d s   o n   h o w   y o u   p r o v i s i o n   n o d e s   a n d   t h e   s e c u r i t y   e x p e c t a t i o n s   y o u   h a v e   a b o u t   y o u r   n e t w o r k   a n d   n o d e   l i f e c y c l e s .


Question: What is Token-based discovery with CA pinning?

Answer: T h i s   i s   t h e   d e f a u l t   m o d e   i n   k u b e a d m .   I n   t h i s   m o d e ,   k u b e a d m   d o w n l o a d s   t h e   c l u s t e r   c o n f i g u r a t i o n   ( i n c l u d i n g   r o o t   C A )   a n d   v a l i d a t e s   i t   u s i n g   t h e   t o k e n   a s   w e l l   a s   v a l i d a t i n g   t h a t   t h e   r o o t   C A   p u b l i c   k e y   m a t c h e s   t h e   p r o v i d e d   h a s h   a n d   t h a t   t h e   A P I   s e r v e r   c e r t i f i c a t e   i s   v a l i d   u n d e r   t h e   r o o t   C A .   T h e   C A   k e y   h a s h   h a s   t h e   f o r m a t   s h a 2 5 6 : < h e x _ e n c o d e d _ h a s h > .   B y   d e f a u l t ,   t h e   h a s h   v a l u e   i s   p r i n t e d   a t   t h e   e n d   o f   t h e   k u b e a d m   i n i t   c o m m a n d   o r   i n   t h e   o u t p u t   f r o m   t h e   k u b e a d m   t o k e n   c r e a t e   - - p r i n t - j o i n - c o m m a n d   c o m m a n d .   I t   i s   i n   a   s t a n d a r d   f o r m a t   ( s e e   R F C 7 4 6 9 )   a n d   c a n   a l s o   b e   c a l c u l a t e d   b y   3 r d   p a r t y   t o o l s   o r   p r o v i s i o n i n g   s y s t e m s .   F o r   e x a m p l e ,   u s i n g   t h e   O p e n S S L   C L I :   o p e n s s l   x 5 0 9   - p u b k e y   - i n   / e t c / k u b e r n e t e s / p k i / c a . c r t   |   o p e n s s l   r s a   - p u b i n   - o u t f o r m   d e r   2 > / d e v / n u l l   |   o p e n s s l   d g s t   - s h a 2 5 6   - h e x   |   s e d   ' s / ^ . *   / / '   E x a m p l e   k u b e a d m   j o i n   c o m m a n d s :   F o r   w o r k e r   n o d e s :   k u b e a d m   j o i n   - - d i s c o v e r y - t o k e n   a b c d e f . 1 2 3 4 5 6 7 8 9 0 a b c d e f   - - d i s c o v e r y - t o k e n - c a - c e r t - h a s h   s h a 2 5 6 : 1 2 3 4 . . c d e f   1 . 2 . 3 . 4 : 6 4 4 3   F o r   c o n t r o l - p l a n e   n o d e s :   k u b e a d m   j o i n   - - d i s


Question: What is Token-based discovery without CA pinning?

Answer: T h i s   m o d e   r e l i e s   o n l y   o n   t h e   s y m m e t r i c   t o k e n   t o   s i g n   ( H M A C - S H A 2 5 6 )   t h e   d i s c o v e r y   i n f o r m a t i o n   t h a t   e s t a b l i s h e s   t h e   r o o t   o f   t r u s t   f o r   t h e   c o n t r o l - p l a n e .   T o   u s e   t h e   m o d e   t h e   j o i n i n g   n o d e s   m u s t   s k i p   t h e   h a s h   v a l i d a t i o n   o f   t h e   C A   p u b l i c   k e y ,   u s i n g   - - d i s c o v e r y - t o k e n - u n s a f e - s k i p - c a - v e r i f i c a t i o n .   Y o u   s h o u l d   c o n s i d e r   u s i n g   o n e   o f   t h e   o t h e r   m o d e s   i f   p o s s i b l e .   E x a m p l e   k u b e a d m   j o i n   c o m m a n d :   k u b e a d m   j o i n   - - t o k e n   a b c d e f . 1 2 3 4 5 6 7 8 9 0 a b c d e f   - - d i s c o v e r y - t o k e n - u n s a f e - s k i p - c a - v e r i f i c a t i o n   1 . 2 . 3 . 4 : 6 4 4 3   A d v a n t a g e s :   S t i l l   p r o t e c t s   a g a i n s t   m a n y   n e t w o r k - l e v e l   a t t a c k s . T h e   t o k e n   c a n   b e   g e n e r a t e d   a h e a d   o f   t i m e   a n d   s h a r e d   w i t h   t h e   c o n t r o l - p l a n e   n o d e   a n d   w o r k e r   n o d e s ,   w h i c h   c a n   t h e n   b o o t s t r a p   i n   p a r a l l e l   w i t h o u t   c o o r d i n a t i o n .   T h i s   a l l o w s   i t   t o   b e   u s e d   i n   m a n y   p r o v i s i o n i n g   s c e n a r i o s .   S t i l l   p r o t e c t s   a g a i n s t   m a n y   n e t w o r k - l e v e l   a t t a c k s .   T h e   t o k e n   c a n   b e   g e n e r a t e d   a h e a d   o f   t i m e   a n d   s h a r e d   w i t h   t h e   c o n t r o l - p l a n e   n o d e   a n d   w o r k e r   n o d e s ,   w h i c h   c a n   t h e n   b o o t s t r a p   i n   p a r a l l e l   w i t h o u t   c o o r d i n a t i o n .   T h i s   a l l o w s   i t   t o   b e   u s e d   i n


Question: What is File or HTTPS-based discovery?

Answer: T h i s   p r o v i d e s   a n   o u t - o f - b a n d   w a y   t o   e s t a b l i s h   a   r o o t   o f   t r u s t   b e t w e e n   t h e   c o n t r o l - p l a n e   n o d e   a n d   b o o t s t r a p p i n g   n o d e s .   C o n s i d e r   u s i n g   t h i s   m o d e   i f   y o u   a r e   b u i l d i n g   a u t o m a t e d   p r o v i s i o n i n g   u s i n g   k u b e a d m .   T h e   f o r m a t   o f   t h e   d i s c o v e r y   f i l e   i s   a   r e g u l a r   K u b e r n e t e s   k u b e c o n f i g   f i l e .   I n   c a s e   t h e   d i s c o v e r y   f i l e   d o e s   n o t   c o n t a i n   c r e d e n t i a l s ,   t h e   T L S   d i s c o v e r y   t o k e n   w i l l   b e   u s e d .   E x a m p l e   k u b e a d m   j o i n   c o m m a n d s :   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   p a t h / t o / f i l e . c o n f   ( l o c a l   f i l e ) k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   h t t p s : / / u r l / f i l e . c o n f   ( r e m o t e   H T T P S   U R L )   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   p a t h / t o / f i l e . c o n f   ( l o c a l   f i l e )   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e   h t t p s : / / u r l / f i l e . c o n f   ( r e m o t e   H T T P S   U R L )   A d v a n t a g e s :   A l l o w s   b o o t s t r a p p i n g   n o d e s   t o   s e c u r e l y   d i s c o v e r   a   r o o t   o f   t r u s t   f o r   t h e   c o n t r o l - p l a n e   n o d e   e v e n   i f   t h e   n e t w o r k   o r   o t h e r   w o r k e r   n o d e s   a r e   c o m p r o m i s e d .   D i s a d v a n t a g e s :   R e q u i r e s   t h a t   y o u   h a v e   s o m e   w a y   t o   c a r r y   t h e   d i s c o v e r y   i n f o r m a t i o n   f r o m   t h e   c o n t r o l - p l a n e   n o d e   t o   t h e   b o o t s t r a p p i n g   n o d e s .   I f   t h e   d i s c o v e r y   f i l e   c o n t a i n s   c r e d e


Question: What is Use of custom kubelet credentials with kubeadm join?

Answer: T o   a l l o w   k u b e a d m   j o i n   t o   u s e   p r e d e f i n e d   k u b e l e t   c r e d e n t i a l s   a n d   s k i p   c l i e n t   T L S   b o o t s t r a p   a n d   C S R   a p p r o v a l   f o r   a   n e w   n o d e :   F r o m   a   w o r k i n g   c o n t r o l   p l a n e   n o d e   i n   t h e   c l u s t e r   t h a t   h a s   / e t c / k u b e r n e t e s / p k i / c a . k e y   e x e c u t e   k u b e a d m   k u b e c o n f i g   u s e r   - - o r g   s y s t e m : n o d e s   - - c l i e n t - n a m e   s y s t e m : n o d e : $ N O D E   >   k u b e l e t . c o n f .   $ N O D E   m u s t   b e   s e t   t o   t h e   n a m e   o f   t h e   n e w   n o d e . M o d i f y   t h e   r e s u l t e d   k u b e l e t . c o n f   m a n u a l l y   t o   a d j u s t   t h e   c l u s t e r   n a m e   a n d   t h e   s e r v e r   e n d p o i n t ,   o r   r u n   k u b e a d m   k u b e c o n f i g   u s e r   - - c o n f i g   ( i t   a c c e p t s   I n i t C o n f i g u r a t i o n ) .   I f   y o u r   c l u s t e r   d o e s   n o t   h a v e   t h e   c a . k e y   f i l e ,   y o u   m u s t   s i g n   t h e   e m b e d d e d   c e r t i f i c a t e s   i n   t h e   k u b e l e t . c o n f   e x t e r n a l l y .   F o r   a d d i t i o n a l   i n f o r m a t i o n ,   s e e   P K I   c e r t i f i c a t e s   a n d   r e q u i r e m e n t s   a n d   C e r t i f i c a t e   M a n a g e m e n t   w i t h   k u b e a d m .   C o p y   t h e   r e s u l t i n g   k u b e l e t . c o n f   t o   / e t c / k u b e r n e t e s / k u b e l e t . c o n f   o n   t h e   n e w   n o d e . E x e c u t e   k u b e a d m   j o i n   w i t h   t h e   f l a g   - - i g n o r e - p r e f l i g h t - e r r o r s = F i l e A v a i l a b l e - - e t c - k u b e r n e t e s - k u b e l e t . c o n f   o n   t h e   n e w   n o d e .


Question: What is Securing your installation even more?

Answer: T h e   d e f a u l t s   f o r   k u b e a d m   m a y   n o t   w o r k   f o r   e v e r y o n e .   T h i s   s e c t i o n   d o c u m e n t s   h o w   t o   t i g h t e n   u p   a   k u b e a d m   i n s t a l l a t i o n   a t   t h e   c o s t   o f   s o m e   u s a b i l i t y .


Question: What is Turning off auto-approval of node client certificates?

Answer: B y   d e f a u l t ,   t h e r e   i s   a   C S R   a u t o - a p p r o v e r   e n a b l e d   t h a t   b a s i c a l l y   a p p r o v e s   a n y   c l i e n t   c e r t i f i c a t e   r e q u e s t   f o r   a   k u b e l e t   w h e n   a   B o o t s t r a p   T o k e n   w a s   u s e d   w h e n   a u t h e n t i c a t i n g .   I f   y o u   d o n ' t   w a n t   t h e   c l u s t e r   t o   a u t o m a t i c a l l y   a p p r o v e   k u b e l e t   c l i e n t   c e r t s ,   y o u   c a n   t u r n   i t   o f f   b y   e x e c u t i n g   t h i s   c o m m a n d :   k u b e c t l   d e l e t e   c l u s t e r r o l e b i n d i n g   k u b e a d m : n o d e - a u t o a p p r o v e - b o o t s t r a p   A f t e r   t h a t ,   k u b e a d m   j o i n   w i l l   b l o c k   u n t i l   t h e   a d m i n   h a s   m a n u a l l y   a p p r o v e d   t h e   C S R   i n   f l i g h t :   U s i n g   k u b e c t l   g e t   c s r ,   y o u   c a n   s e e   t h a t   t h e   o r i g i n a l   C S R   i s   i n   t h e   P e n d i n g   s t a t e . k u b e c t l   g e t   c s r   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   A G E   R E Q U E S T O R   C O N D I T I O N   n o d e - c s r - c 6 9 H X e 7 a Y c q k S 1 b K m H 4 f a E n H A W x n 6 i 2 b H Z 2 m D 0 4 j Z y Q   1 8 s   s y s t e m : b o o t s t r a p : 8 7 8 f 0 7   P e n d i n g   k u b e c t l   c e r t i f i c a t e   a p p r o v e   a l l o w s   t h e   a d m i n   t o   a p p r o v e   C S R . T h i s   a c t i o n   t e l l s   a   c e r t i f i c a t e   s i g n i n g   c o n t r o l l e r   t o   i s s u e   a   c e r t i f i c a t e   t o   t h e   r e q u e s t o r   w i t h   t h e   a t t r i b u t e s   r e q u e s t e d   i n   t h e   C S R . k u b e c t l   c e r t i f i c a t e   a p p r o v e   n o d e - c s r - c 6 9 H X e 7 a Y c q k S 1 b K m H 4 f a E n H A W x n 6 i 2 b H Z 2 m D 0 4 j Z y Q   T h e   o u t p u t   i s   s i m i l a r   t o


Question: What is Turning off public access to the cluster-info ConfigMap?

Answer: I n   o r d e r   t o   a c h i e v e   t h e   j o i n i n g   f l o w   u s i n g   t h e   t o k e n   a s   t h e   o n l y   p i e c e   o f   v a l i d a t i o n   i n f o r m a t i o n ,   a   C o n f i g M a p   w i t h   s o m e   d a t a   n e e d e d   f o r   v a l i d a t i o n   o f   t h e   c o n t r o l - p l a n e   n o d e ' s   i d e n t i t y   i s   e x p o s e d   p u b l i c l y   b y   d e f a u l t .   W h i l e   t h e r e   i s   n o   p r i v a t e   d a t a   i n   t h i s   C o n f i g M a p ,   s o m e   u s e r s   m i g h t   w i s h   t o   t u r n   i t   o f f   r e g a r d l e s s .   D o i n g   s o   w i l l   d i s a b l e   t h e   a b i l i t y   t o   u s e   t h e   - - d i s c o v e r y - t o k e n   f l a g   o f   t h e   k u b e a d m   j o i n   f l o w .   H e r e   a r e   t h e   s t e p s   t o   d o   s o :   F e t c h   t h e   c l u s t e r - i n f o   f i l e   f r o m   t h e   A P I   S e r v e r :   k u b e c t l   - n   k u b e - p u b l i c   g e t   c m   c l u s t e r - i n f o   - o   j s o n p a t h = ' { . d a t a . k u b e c o n f i g } '   |   t e e   c l u s t e r - i n f o . y a m l   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   a p i V e r s i o n :   v 1   k i n d :   C o n f i g   c l u s t e r s :   -   c l u s t e r :   c e r t i f i c a t e - a u t h o r i t y - d a t a :   < c a - c e r t >   s e r v e r :   h t t p s : / / < i p > : < p o r t >   n a m e :   " "   c o n t e x t s :   [ ]   c u r r e n t - c o n t e x t :   " "   p r e f e r e n c e s :   { }   u s e r s :   [ ]   U s e   t h e   c l u s t e r - i n f o . y a m l   f i l e   a s   a n   a r g u m e n t   t o   k u b e a d m   j o i n   - - d i s c o v e r y - f i l e . T u r n   o f f   p u b l i c   a c c e s s   t o   t h e   c l u s t e r - i n f o   C o n f i g M a p :   U s e   t h e   c l u s t e r - i n f o . y a m l   f i l e   a s   a n   a r g u m e n t   t o   k u b e a d m   j o i n   - - d i


Question: What is Caution:?

Answer: I t ' s   p o s s i b l e   t o   c o n f i g u r e   k u b e a d m   j o i n   w i t h   a   c o n f i g u r a t i o n   f i l e   i n s t e a d   o f   c o m m a n d   l i n e   f l a g s ,   a n d   s o m e   m o r e   a d v a n c e d   f e a t u r e s   m a y   o n l y   b e   a v a i l a b l e   a s   c o n f i g u r a t i o n   f i l e   o p t i o n s .   T h i s   f i l e   i s   p a s s e d   u s i n g   t h e   - - c o n f i g   f l a g   a n d   i t   m u s t   c o n t a i n   a   J o i n C o n f i g u r a t i o n   s t r u c t u r e .   M i x i n g   - - c o n f i g   w i t h   o t h e r s   f l a g s   m a y   n o t   b e   a l l o w e d   i n   s o m e   c a s e s .   T h e   d e f a u l t   c o n f i g u r a t i o n   c a n   b e   p r i n t e d   o u t   u s i n g   t h e   k u b e a d m   c o n f i g   p r i n t   c o m m a n d .   I f   y o u r   c o n f i g u r a t i o n   i s   n o t   u s i n g   t h e   l a t e s t   v e r s i o n   i t   i s   r e c o m m e n d e d   t h a t   y o u   m i g r a t e   u s i n g   t h e   k u b e a d m   c o n f i g   m i g r a t e   c o m m a n d .   F o r   m o r e   i n f o r m a t i o n   o n   t h e   f i e l d s   a n d   u s a g e   o f   t h e   c o n f i g u r a t i o n   y o u   c a n   n a v i g a t e   t o   o u r   A P I   r e f e r e n c e .


Question: What is What's next?

Answer: k u b e a d m   i n i t   t o   b o o t s t r a p   a   K u b e r n e t e s   c o n t r o l - p l a n e   n o d e . k u b e a d m   t o k e n   t o   m a n a g e   t o k e n s   f o r   k u b e a d m   j o i n . k u b e a d m   r e s e t   t o   r e v e r t   a n y   c h a n g e s   m a d e   t o   t h i s   h o s t   b y   k u b e a d m   i n i t   o r   k u b e a d m   j o i n .


Question: What is Submitting case studies?

Answer: Submitting case studiesCase studies highlight how organizations are using Kubernetes to solve real-world problems. The Kubernetes marketing team and members of the CNCF collaborate with you on all case studies.Case studies require extensive review before they're approved.Submit a case studyHave a look at the source for the existing case studies.Refer to the case study guidelines and submit your request as outlined in the guidelines.


Question: How does Submitting case studies work?

Answer: Submitting case studiesCase studies highlight how organizations are using Kubernetes to solve real-world problems. The Kubernetes marketing team and members of the CNCF collaborate with you on all case studies.Case studies require extensive review before they're approved.Submit a case studyHave a look at the source for the existing case studies.Refer to the case study guidelines and submit your request as outlined in the guidelines.