Question: When would you use SubjectAccessReview?

Answer: SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1kind: SubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SubjectAccessReviewSpec), requiredSpec holds information about the request being evaluatedstatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSubjectAccessReviewSpecSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setextra (map[string][]string)Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.groups ([]string)Atomic: will be replaced during a mergeGroups is the groups you're testing for.nonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook imp


Question: What are the benefits of SubjectAccessReview?

Answer: SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.apiVersion: authorization.k8s.io/v1kind: SubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SubjectAccessReviewSpec), requiredSpec holds information about the request being evaluatedstatus (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notSubjectAccessReviewSpecSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be setextra (map[string][]string)Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.groups ([]string)Atomic: will be replaced during a mergeGroups is the groups you're testing for.nonResourceAttributes (NonResourceAttributes)NonResourceAttributes describes information for a non-resource access requestNonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interfacenonResourceAttributes.path (string)Path is the URL path of the requestnonResourceAttributes.verb (string)Verb is the standard HTTP verbresourceAttributes (ResourceAttributes)ResourceAuthorizationAttributes describes information for a resource access requestResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfaceresourceAttributes.fieldSelector (FieldSelectorAttributes)fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.*FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.resourceAttributes.fieldSelector.rawSelector (string)rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook imp


Question: What is SubjectAccessReview?

Answer: a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / a u t h o r i z a t i o n / v 1 "


Question: What is SubjectAccessReview?

Answer: S u b j e c t A c c e s s R e v i e w   c h e c k s   w h e t h e r   o r   n o t   a   u s e r   o r   g r o u p   c a n   p e r f o r m   a n   a c t i o n .   a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   S u b j e c t A c c e s s R e v i e w m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( S u b j e c t A c c e s s R e v i e w S p e c ) ,   r e q u i r e d S p e c   h o l d s   i n f o r m a t i o n   a b o u t   t h e   r e q u e s t   b e i n g   e v a l u a t e d s t a t u s   ( S u b j e c t A c c e s s R e v i e w S t a t u s ) S t a t u s   i s   f i l l e d   i n   b y   t h e   s e r v e r   a n d   i n d i c a t e s   w h e t h e r   t h e   r e q u e s t   i s   a l l o w e d   o r   n o t   a p i V e r s i o n :   a u t h o r i z a t i o n . k 8 s . i o / v 1   k i n d :   S u b j e c t A c c e s s R e v i e w   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( S u b j e c t A c c e s s R e v i e w S p e c ) ,   r e q u i r e d   S p e c   h o l d s   i n f o r m a t i o n   a b o u t   t h e   r e q u e s t   b e i n g   e v a l u a t e d   s t a t u s   ( S u b j e c t A c c e s s R e v i e w S t a t u s )   S t a t u s   i s   f i l l e d   i n   b y   t h e   s e r v e r   a n d   i n d i c a t e s   w h e t h e r   t h e   r e q u e s t   i s   a l l o w e d   o r   n o t


Question: What is SubjectAccessReviewSpec?

Answer: S u b j e c t A c c e s s R e v i e w S p e c   i s   a   d e s c r i p t i o n   o f   t h e   a c c e s s   r e q u e s t .   E x a c t l y   o n e   o f   R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   a n d   N o n R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   m u s t   b e   s e t   e x t r a   ( m a p [ s t r i n g ] [ ] s t r i n g ) E x t r a   c o r r e s p o n d s   t o   t h e   u s e r . I n f o . G e t E x t r a ( )   m e t h o d   f r o m   t h e   a u t h e n t i c a t o r .   S i n c e   t h a t   i s   i n p u t   t o   t h e   a u t h o r i z e r   i t   n e e d s   a   r e f l e c t i o n   h e r e . g r o u p s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e G r o u p s   i s   t h e   g r o u p s   y o u ' r e   t e s t i n g   f o r . n o n R e s o u r c e A t t r i b u t e s   ( N o n R e s o u r c e A t t r i b u t e s ) N o n R e s o u r c e A t t r i b u t e s   d e s c r i b e s   i n f o r m a t i o n   f o r   a   n o n - r e s o u r c e   a c c e s s   r e q u e s t N o n R e s o u r c e A t t r i b u t e s   i n c l u d e s   t h e   a u t h o r i z a t i o n   a t t r i b u t e s   a v a i l a b l e   f o r   n o n - r e s o u r c e   r e q u e s t s   t o   t h e   A u t h o r i z e r   i n t e r f a c e n o n R e s o u r c e A t t r i b u t e s . p a t h   ( s t r i n g ) P a t h   i s   t h e   U R L   p a t h   o f   t h e   r e q u e s t n o n R e s o u r c e A t t r i b u t e s . v e r b   ( s t r i n g ) V e r b   i s   t h e   s t a n d a r d   H T T P   v e r b r e s o u r c e A t t r i b u t e s   ( R e s o u r c e A t t r i b u t e s ) R e s o u r c e A u t h o r i z a t i o n A t t r i b u t e s   d e s c r i b e s   i n f o r m a t i o n   f o r   a   r e s o u r c e   a c c e s s   r e q u e s t R e s o u r c e A t t r i b u t e s   i n c l u d e s   t h e   a u t h o r i z a t i o n   a t t r i b u t e s   a v a i l a b l e   f o r


Question: What is SubjectAccessReviewStatus?

Answer: S u b j e c t A c c e s s R e v i e w S t a t u s   a l l o w e d   ( b o o l e a n ) ,   r e q u i r e d A l l o w e d   i s   r e q u i r e d .   T r u e   i f   t h e   a c t i o n   w o u l d   b e   a l l o w e d ,   f a l s e   o t h e r w i s e . d e n i e d   ( b o o l e a n ) D e n i e d   i s   o p t i o n a l .   T r u e   i f   t h e   a c t i o n   w o u l d   b e   d e n i e d ,   o t h e r w i s e   f a l s e .   I f   b o t h   a l l o w e d   i s   f a l s e   a n d   d e n i e d   i s   f a l s e ,   t h e n   t h e   a u t h o r i z e r   h a s   n o   o p i n i o n   o n   w h e t h e r   t o   a u t h o r i z e   t h e   a c t i o n .   D e n i e d   m a y   n o t   b e   t r u e   i f   A l l o w e d   i s   t r u e . e v a l u a t i o n E r r o r   ( s t r i n g ) E v a l u a t i o n E r r o r   i s   a n   i n d i c a t i o n   t h a t   s o m e   e r r o r   o c c u r r e d   d u r i n g   t h e   a u t h o r i z a t i o n   c h e c k .   I t   i s   e n t i r e l y   p o s s i b l e   t o   g e t   a n   e r r o r   a n d   b e   a b l e   t o   c o n t i n u e   d e t e r m i n e   a u t h o r i z a t i o n   s t a t u s   i n   s p i t e   o f   i t .   F o r   i n s t a n c e ,   R B A C   c a n   b e   m i s s i n g   a   r o l e ,   b u t   e n o u g h   r o l e s   a r e   s t i l l   p r e s e n t   a n d   b o u n d   t o   r e a s o n   a b o u t   t h e   r e q u e s t . r e a s o n   ( s t r i n g ) R e a s o n   i s   o p t i o n a l .   I t   i n d i c a t e s   w h y   a   r e q u e s t   w a s   a l l o w e d   o r   d e n i e d .   a l l o w e d   ( b o o l e a n ) ,   r e q u i r e d   A l l o w e d   i s   r e q u i r e d .   T r u e   i f   t h e   a c t i o n   w o u l d   b e   a l l o w e d ,   f a l s e   o t h e r w i s e .   d e n i e d   ( b o o l e a n )   D e n i e d   i s   o p t i o n a l .   T r u e   i f   t h e   a c t i o n   w o u l d   b e   d e n i e d ,   o t h e r w i s e   f a l s e .   I f   b o t h


Question: What is HTTP Request?

Answer: P O S T   / a p i s / a u t h o r i z a t i o n . k 8 s . i o / v 1 / s u b j e c t a c c e s s r e v i e w s


Question: What is Parameters?

Answer: b o d y :   S u b j e c t A c c e s s R e v i e w ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   S u b j e c t A c c e s s R e v i e w ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S u b j e c t A c c e s s R e v i e w ) :   O K   2 0 1   ( S u b j e c t A c c e s s R e v i e w ) :   C r e a t e d   2 0 2   ( S u b j e c t A c c e s s R e v i e w ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is PodCertificateRequest v1alpha1?

Answer: PodCertificateRequest v1alpha1PodCertificateRequest encodes a pod requesting a certificate from a given signer.apiVersion: certificates.k8s.io/v1alpha1import "k8s.io/api/certificates/v1alpha1"PodCertificateRequestPodCertificateRequest encodes a pod requesting a certificate from a given signer.Kubelets use this API to implement podCertificate projected volumesapiVersion: certificates.k8s.io/v1alpha1kind: PodCertificateRequestmetadata (ObjectMeta)metadata contains the object metadata.spec (PodCertificateRequestSpec), requiredspec contains the details about the certificate being requested.status (PodCertificateRequestStatus)status contains the issued certificate, and a standard set of conditions.PodCertificateRequestSpecPodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.nodeName (string), requirednodeName is the name of the node the pod is assigned to.nodeUID (string), requirednodeUID is the UID of the node the pod is assigned to.pkixPublicKey ([]byte), requiredpkixPublicKey is the PKIX-serialized public key the signer will issue the certificate to.The key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in the future.Signer implementations do not need to support all key types supported by kube-apiserver and kubelet. If a signer does not support the key type used for a given PodCertificateRequest, it must deny the request by setting a status.conditions entry with a type of "Denied" and a reason of "UnsupportedKeyType". It may also suggest a key type that it does support in the message field.podName (string), requiredpodName is the name of the pod into which the certificate will be mounted.podUID (string), requiredpodUID is the UID of the pod into which the certificate will be mounted.proofOfPossession ([]byte), requiredproofOfPossession proves that the requesting kubelet holds the private key corresponding to pkixPublicKey.It is contructed by signing the ASCII bytes of the pod's UID using pkixPublicKey.kube-apiserver validates the proof of possession during creation of the PodCertificateRequest.If the key is an RSA key, then the signature is over the ASCII bytes of the pod UID, using RSASSA-PSS from RFC 8017 (as implemented by the golang function crypto/rsa.SignPSS with nil options).If the key is an ECDSA key, then the signature is as described by SEC 1, Version 2.0 (as implemented by the golang library function crypto/ecdsa.SignASN1)If the key is an ED25519 key, the the signature is as described by the ED25519 Specification (as implemented by the golang library crypto/ed25519.Sign).serviceAccountName (string), requiredserviceAccountName is the name of the service account the pod is running as.serviceAccountUID (string), requiredserviceAccountUID is the UID of the service account the pod is running as.signerName (string), requiredsignerName indicates the requested signer.All signer names beginning with kubernetes.io are reserved for use


Question: How does PodCertificateRequest v1alpha1 work?

Answer: PodCertificateRequest v1alpha1PodCertificateRequest encodes a pod requesting a certificate from a given signer.apiVersion: certificates.k8s.io/v1alpha1import "k8s.io/api/certificates/v1alpha1"PodCertificateRequestPodCertificateRequest encodes a pod requesting a certificate from a given signer.Kubelets use this API to implement podCertificate projected volumesapiVersion: certificates.k8s.io/v1alpha1kind: PodCertificateRequestmetadata (ObjectMeta)metadata contains the object metadata.spec (PodCertificateRequestSpec), requiredspec contains the details about the certificate being requested.status (PodCertificateRequestStatus)status contains the issued certificate, and a standard set of conditions.PodCertificateRequestSpecPodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.nodeName (string), requirednodeName is the name of the node the pod is assigned to.nodeUID (string), requirednodeUID is the UID of the node the pod is assigned to.pkixPublicKey ([]byte), requiredpkixPublicKey is the PKIX-serialized public key the signer will issue the certificate to.The key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in the future.Signer implementations do not need to support all key types supported by kube-apiserver and kubelet. If a signer does not support the key type used for a given PodCertificateRequest, it must deny the request by setting a status.conditions entry with a type of "Denied" and a reason of "UnsupportedKeyType". It may also suggest a key type that it does support in the message field.podName (string), requiredpodName is the name of the pod into which the certificate will be mounted.podUID (string), requiredpodUID is the UID of the pod into which the certificate will be mounted.proofOfPossession ([]byte), requiredproofOfPossession proves that the requesting kubelet holds the private key corresponding to pkixPublicKey.It is contructed by signing the ASCII bytes of the pod's UID using pkixPublicKey.kube-apiserver validates the proof of possession during creation of the PodCertificateRequest.If the key is an RSA key, then the signature is over the ASCII bytes of the pod UID, using RSASSA-PSS from RFC 8017 (as implemented by the golang function crypto/rsa.SignPSS with nil options).If the key is an ECDSA key, then the signature is as described by SEC 1, Version 2.0 (as implemented by the golang library function crypto/ecdsa.SignASN1)If the key is an ED25519 key, the the signature is as described by the ED25519 Specification (as implemented by the golang library crypto/ed25519.Sign).serviceAccountName (string), requiredserviceAccountName is the name of the service account the pod is running as.serviceAccountUID (string), requiredserviceAccountUID is the UID of the service account the pod is running as.signerName (string), requiredsignerName indicates the requested signer.All signer names beginning with kubernetes.io are reserved for use


Question: When would you use PodCertificateRequest v1alpha1?

Answer: PodCertificateRequest v1alpha1PodCertificateRequest encodes a pod requesting a certificate from a given signer.apiVersion: certificates.k8s.io/v1alpha1import "k8s.io/api/certificates/v1alpha1"PodCertificateRequestPodCertificateRequest encodes a pod requesting a certificate from a given signer.Kubelets use this API to implement podCertificate projected volumesapiVersion: certificates.k8s.io/v1alpha1kind: PodCertificateRequestmetadata (ObjectMeta)metadata contains the object metadata.spec (PodCertificateRequestSpec), requiredspec contains the details about the certificate being requested.status (PodCertificateRequestStatus)status contains the issued certificate, and a standard set of conditions.PodCertificateRequestSpecPodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.nodeName (string), requirednodeName is the name of the node the pod is assigned to.nodeUID (string), requirednodeUID is the UID of the node the pod is assigned to.pkixPublicKey ([]byte), requiredpkixPublicKey is the PKIX-serialized public key the signer will issue the certificate to.The key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in the future.Signer implementations do not need to support all key types supported by kube-apiserver and kubelet. If a signer does not support the key type used for a given PodCertificateRequest, it must deny the request by setting a status.conditions entry with a type of "Denied" and a reason of "UnsupportedKeyType". It may also suggest a key type that it does support in the message field.podName (string), requiredpodName is the name of the pod into which the certificate will be mounted.podUID (string), requiredpodUID is the UID of the pod into which the certificate will be mounted.proofOfPossession ([]byte), requiredproofOfPossession proves that the requesting kubelet holds the private key corresponding to pkixPublicKey.It is contructed by signing the ASCII bytes of the pod's UID using pkixPublicKey.kube-apiserver validates the proof of possession during creation of the PodCertificateRequest.If the key is an RSA key, then the signature is over the ASCII bytes of the pod UID, using RSASSA-PSS from RFC 8017 (as implemented by the golang function crypto/rsa.SignPSS with nil options).If the key is an ECDSA key, then the signature is as described by SEC 1, Version 2.0 (as implemented by the golang library function crypto/ecdsa.SignASN1)If the key is an ED25519 key, the the signature is as described by the ED25519 Specification (as implemented by the golang library crypto/ed25519.Sign).serviceAccountName (string), requiredserviceAccountName is the name of the service account the pod is running as.serviceAccountUID (string), requiredserviceAccountUID is the UID of the service account the pod is running as.signerName (string), requiredsignerName indicates the requested signer.All signer names beginning with kubernetes.io are reserved for use


Question: What are the benefits of PodCertificateRequest v1alpha1?

Answer: PodCertificateRequest v1alpha1PodCertificateRequest encodes a pod requesting a certificate from a given signer.apiVersion: certificates.k8s.io/v1alpha1import "k8s.io/api/certificates/v1alpha1"PodCertificateRequestPodCertificateRequest encodes a pod requesting a certificate from a given signer.Kubelets use this API to implement podCertificate projected volumesapiVersion: certificates.k8s.io/v1alpha1kind: PodCertificateRequestmetadata (ObjectMeta)metadata contains the object metadata.spec (PodCertificateRequestSpec), requiredspec contains the details about the certificate being requested.status (PodCertificateRequestStatus)status contains the issued certificate, and a standard set of conditions.PodCertificateRequestSpecPodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.nodeName (string), requirednodeName is the name of the node the pod is assigned to.nodeUID (string), requirednodeUID is the UID of the node the pod is assigned to.pkixPublicKey ([]byte), requiredpkixPublicKey is the PKIX-serialized public key the signer will issue the certificate to.The key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in the future.Signer implementations do not need to support all key types supported by kube-apiserver and kubelet. If a signer does not support the key type used for a given PodCertificateRequest, it must deny the request by setting a status.conditions entry with a type of "Denied" and a reason of "UnsupportedKeyType". It may also suggest a key type that it does support in the message field.podName (string), requiredpodName is the name of the pod into which the certificate will be mounted.podUID (string), requiredpodUID is the UID of the pod into which the certificate will be mounted.proofOfPossession ([]byte), requiredproofOfPossession proves that the requesting kubelet holds the private key corresponding to pkixPublicKey.It is contructed by signing the ASCII bytes of the pod's UID using pkixPublicKey.kube-apiserver validates the proof of possession during creation of the PodCertificateRequest.If the key is an RSA key, then the signature is over the ASCII bytes of the pod UID, using RSASSA-PSS from RFC 8017 (as implemented by the golang function crypto/rsa.SignPSS with nil options).If the key is an ECDSA key, then the signature is as described by SEC 1, Version 2.0 (as implemented by the golang library function crypto/ecdsa.SignASN1)If the key is an ED25519 key, the the signature is as described by the ED25519 Specification (as implemented by the golang library crypto/ed25519.Sign).serviceAccountName (string), requiredserviceAccountName is the name of the service account the pod is running as.serviceAccountUID (string), requiredserviceAccountUID is the UID of the service account the pod is running as.signerName (string), requiredsignerName indicates the requested signer.All signer names beginning with kubernetes.io are reserved for use


Question: What is PodCertificateRequest v1alpha1?

Answer: a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1   i m p o r t   " k 8 s . i o / a p i / c e r t i f i c a t e s / v 1 a l p h a 1 "


Question: What is PodCertificateRequest?

Answer: P o d C e r t i f i c a t e R e q u e s t   e n c o d e s   a   p o d   r e q u e s t i n g   a   c e r t i f i c a t e   f r o m   a   g i v e n   s i g n e r .   K u b e l e t s   u s e   t h i s   A P I   t o   i m p l e m e n t   p o d C e r t i f i c a t e   p r o j e c t e d   v o l u m e s   a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 k i n d :   P o d C e r t i f i c a t e R e q u e s t m e t a d a t a   ( O b j e c t M e t a ) m e t a d a t a   c o n t a i n s   t h e   o b j e c t   m e t a d a t a . s p e c   ( P o d C e r t i f i c a t e R e q u e s t S p e c ) ,   r e q u i r e d s p e c   c o n t a i n s   t h e   d e t a i l s   a b o u t   t h e   c e r t i f i c a t e   b e i n g   r e q u e s t e d . s t a t u s   ( P o d C e r t i f i c a t e R e q u e s t S t a t u s ) s t a t u s   c o n t a i n s   t h e   i s s u e d   c e r t i f i c a t e ,   a n d   a   s t a n d a r d   s e t   o f   c o n d i t i o n s .   a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1   k i n d :   P o d C e r t i f i c a t e R e q u e s t   m e t a d a t a   ( O b j e c t M e t a )   m e t a d a t a   c o n t a i n s   t h e   o b j e c t   m e t a d a t a .   s p e c   ( P o d C e r t i f i c a t e R e q u e s t S p e c ) ,   r e q u i r e d   s p e c   c o n t a i n s   t h e   d e t a i l s   a b o u t   t h e   c e r t i f i c a t e   b e i n g   r e q u e s t e d .   s t a t u s   ( P o d C e r t i f i c a t e R e q u e s t S t a t u s )   s t a t u s   c o n t a i n s   t h e   i s s u e d   c e r t i f i c a t e ,   a n d   a   s t a n d a r d   s e t   o f   c o n d i t i o n s .


Question: What is PodCertificateRequestSpec?

Answer: P o d C e r t i f i c a t e R e q u e s t S p e c   d e s c r i b e s   t h e   c e r t i f i c a t e   r e q u e s t .   A l l   f i e l d s   a r e   i m m u t a b l e   a f t e r   c r e a t i o n .   n o d e N a m e   ( s t r i n g ) ,   r e q u i r e d n o d e N a m e   i s   t h e   n a m e   o f   t h e   n o d e   t h e   p o d   i s   a s s i g n e d   t o . n o d e U I D   ( s t r i n g ) ,   r e q u i r e d n o d e U I D   i s   t h e   U I D   o f   t h e   n o d e   t h e   p o d   i s   a s s i g n e d   t o . p k i x P u b l i c K e y   ( [ ] b y t e ) ,   r e q u i r e d p k i x P u b l i c K e y   i s   t h e   P K I X - s e r i a l i z e d   p u b l i c   k e y   t h e   s i g n e r   w i l l   i s s u e   t h e   c e r t i f i c a t e   t o . T h e   k e y   m u s t   b e   o n e   o f   R S A 3 0 7 2 ,   R S A 4 0 9 6 ,   E C D S A P 2 5 6 ,   E C D S A P 3 8 4 ,   E C D S A P 5 2 1 ,   o r   E D 2 5 5 1 9 .   N o t e   t h a t   t h i s   l i s t   m a y   b e   e x p a n d e d   i n   t h e   f u t u r e . S i g n e r   i m p l e m e n t a t i o n s   d o   n o t   n e e d   t o   s u p p o r t   a l l   k e y   t y p e s   s u p p o r t e d   b y   k u b e - a p i s e r v e r   a n d   k u b e l e t .   I f   a   s i g n e r   d o e s   n o t   s u p p o r t   t h e   k e y   t y p e   u s e d   f o r   a   g i v e n   P o d C e r t i f i c a t e R e q u e s t ,   i t   m u s t   d e n y   t h e   r e q u e s t   b y   s e t t i n g   a   s t a t u s . c o n d i t i o n s   e n t r y   w i t h   a   t y p e   o f   " D e n i e d "   a n d   a   r e a s o n   o f   " U n s u p p o r t e d K e y T y p e " .   I t   m a y   a l s o   s u g g e s t   a   k e y   t y p e   t h a t   i t   d o e s   s u p p o r t   i n   t h e   m e s s a g e   f i e l d . p o d N a m e   ( s t r i n g ) ,   r e q u i r e d p o d N a m e   i s   t h e   n a m e   o f   t h e   p o d   i n t o   w h i c h   t h e   c e r t i f i c a t e   w i l l   b e   m o u n t e


Question: What is PodCertificateRequestStatus?

Answer: P o d C e r t i f i c a t e R e q u e s t S t a t u s   d e s c r i b e s   t h e   s t a t u s   o f   t h e   r e q u e s t ,   a n d   h o l d s   t h e   c e r t i f i c a t e   d a t a   i f   t h e   r e q u e s t   i s   i s s u e d .   b e g i n R e f r e s h A t   ( T i m e ) b e g i n R e f r e s h A t   i s   t h e   t i m e   a t   w h i c h   t h e   k u b e l e t   s h o u l d   b e g i n   t r y i n g   t o   r e f r e s h   t h e   c e r t i f i c a t e .   T h i s   f i e l d   i s   s e t   v i a   t h e   / s t a t u s   s u b r e s o u r c e ,   a n d   m u s t   b e   s e t   a t   t h e   s a m e   t i m e   a s   c e r t i f i c a t e C h a i n .   O n c e   p o p u l a t e d ,   t h i s   f i e l d   i s   i m m u t a b l e . T h i s   f i e l d   i s   o n l y   a   h i n t .   K u b e l e t   m a y   s t a r t   r e f r e s h i n g   b e f o r e   o r   a f t e r   t h i s   t i m e   i f   n e c e s s a r y . T i m e   i s   a   w r a p p e r   a r o u n d   t i m e . T i m e   w h i c h   s u p p o r t s   c o r r e c t   m a r s h a l i n g   t o   Y A M L   a n d   J S O N .   W r a p p e r s   a r e   p r o v i d e d   f o r   m a n y   o f   t h e   f a c t o r y   m e t h o d s   t h a t   t h e   t i m e   p a c k a g e   o f f e r s . c e r t i f i c a t e C h a i n   ( s t r i n g ) c e r t i f i c a t e C h a i n   i s   p o p u l a t e d   w i t h   a n   i s s u e d   c e r t i f i c a t e   b y   t h e   s i g n e r .   T h i s   f i e l d   i s   s e t   v i a   t h e   / s t a t u s   s u b r e s o u r c e .   O n c e   p o p u l a t e d ,   t h i s   f i e l d   i s   i m m u t a b l e . I f   t h e   c e r t i f i c a t e   s i g n i n g   r e q u e s t   i s   d e n i e d ,   a   c o n d i t i o n   o f   t y p e   " D e n i e d "   i s   a d d e d   a n d   t h i s   f i e l d   r e m a i n s   e m p t y .   I f   t h e   s i g n e r   c a n n o t   i s s u e   t h e   c e r t i f i c a t e ,   a   c o n d i t i o n   o


Question: What is PodCertificateRequestList?

Answer: P o d C e r t i f i c a t e R e q u e s t L i s t   i s   a   c o l l e c t i o n   o f   P o d C e r t i f i c a t e R e q u e s t   o b j e c t s   a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 k i n d :   P o d C e r t i f i c a t e R e q u e s t L i s t m e t a d a t a   ( L i s t M e t a ) m e t a d a t a   c o n t a i n s   t h e   l i s t   m e t a d a t a . i t e m s   ( [ ] P o d C e r t i f i c a t e R e q u e s t ) ,   r e q u i r e d i t e m s   i s   a   c o l l e c t i o n   o f   P o d C e r t i f i c a t e R e q u e s t   o b j e c t s   a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1   k i n d :   P o d C e r t i f i c a t e R e q u e s t L i s t   m e t a d a t a   ( L i s t M e t a )   m e t a d a t a   c o n t a i n s   t h e   l i s t   m e t a d a t a .   i t e m s   ( [ ] P o d C e r t i f i c a t e R e q u e s t ) ,   r e q u i r e d   i t e m s   i s   a   c o l l e c t i o n   o f   P o d C e r t i f i c a t e R e q u e s t   o b j e c t s


Question: What is HTTP Request?

Answer: G E T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / p o d c e r t i f i c a t e r e q u e s t s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   2 0 1   ( P o d C e r t i f i c a t e R e q u e s t ) :   C r e a t e d   2 0 2   ( P o d C e r t i f i c a t e R e q u e s t ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   2 0 1   ( P o d C e r t i f i c a t e R e q u e s t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P o d C e r t i f i c a t e R e q u e s t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   2 0 1   ( P o d C e r t i f i c a t e R e q u e s t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   2 0 1   ( P o d C e r t i f i c a t e R e q u e s t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( P o d C e r t i f i c a t e R e q u e s t ) :   O K   2 0 1   ( P o d C e r t i f i c a t e R e q u e s t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   P o d C e r t i f i c a t e R e q u e s t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   2 0 2   ( S t a t u s ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / c e r t i f i c a t e s . k 8 s . i o / v 1 a l p h a 1 / n a m e s p a c e s / { n a m e s p a c e } / p o d c e r t i f i c a t e r e q u e s t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Container Runtimes?

Answer: Container RuntimesNote: Dockershim has been removed from the Kubernetes project as of release 1.24. Read the Dockershim Removal FAQ for further details.You need to install a container runtime into each node in the cluster so that Pods can run there. This page outlines what is involved and describes related tasks for setting up nodes.Kubernetes 1.34 requires that you use a runtime that conforms with the Container Runtime Interface (CRI).See CRI version support for more information.This page provides an outline of how to use several common container runtimes with Kubernetes.containerdCRI-ODocker EngineMirantis Container RuntimeNote:Kubernetes releases before v1.24 included a direct integration with Docker Engine, using a component named dockershim. That special direct integration is no longer part of Kubernetes (this removal was announced as part of the v1.20 release). You can read Check whether Dockershim removal affects you to understand how this removal might affect you. To learn about migrating from using dockershim, see Migrating from dockershim.If you are running a version of Kubernetes other than v1.34, check the documentation for that version.Install and configure prerequisitesNetwork configurationBy default, the Linux kernel does not allow IPv4 packets to be routed between interfaces. Most Kubernetes cluster networking implementations will change this setting (if needed), but some might expect the administrator to do it for them. (Some might also expect other sysctl parameters to be set, kernel modules to be loaded, etc; consult the documentation for your specific network implementation.)Enable IPv4 packet forwardingTo manually enable IPv4 packet forwarding:# sysctl params required by setup, params persist across reboots cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf net.ipv4.ip_forward = 1 EOF # Apply sysctl params without reboot sudo sysctl --system Verify that net.ipv4.ip_forward is set to 1 with:sysctl net.ipv4.ip_forward cgroup driversOn Linux, control groups are used to constrain resources that are allocated to processes.Both the kubelet and the underlying container runtime need to interface with control groups to enforce resource management for pods and containers and set resources such as cpu/memory requests and limits. To interface with control groups, the kubelet and the container runtime need to use a cgroup driver. It's critical that the kubelet and the container runtime use the same cgroup driver and are configured the same.There are two cgroup drivers available:cgroupfssystemdcgroupfs driverThe cgroupfs driver is the default cgroup driver in the kubelet. When the cgroupfs driver is used, the kubelet and the container runtime directly interface with the cgroup filesystem to configure cgroups.The cgroupfs driver is not recommended when systemd is the init system because systemd expects a single cgroup manager on the system. Additionally, if you use cgroup v2, use the systemd cgroup driver instead of cgroupfs.systemd cgroup driverW


Question: How does Container Runtimes work?

Answer: Container RuntimesNote: Dockershim has been removed from the Kubernetes project as of release 1.24. Read the Dockershim Removal FAQ for further details.You need to install a container runtime into each node in the cluster so that Pods can run there. This page outlines what is involved and describes related tasks for setting up nodes.Kubernetes 1.34 requires that you use a runtime that conforms with the Container Runtime Interface (CRI).See CRI version support for more information.This page provides an outline of how to use several common container runtimes with Kubernetes.containerdCRI-ODocker EngineMirantis Container RuntimeNote:Kubernetes releases before v1.24 included a direct integration with Docker Engine, using a component named dockershim. That special direct integration is no longer part of Kubernetes (this removal was announced as part of the v1.20 release). You can read Check whether Dockershim removal affects you to understand how this removal might affect you. To learn about migrating from using dockershim, see Migrating from dockershim.If you are running a version of Kubernetes other than v1.34, check the documentation for that version.Install and configure prerequisitesNetwork configurationBy default, the Linux kernel does not allow IPv4 packets to be routed between interfaces. Most Kubernetes cluster networking implementations will change this setting (if needed), but some might expect the administrator to do it for them. (Some might also expect other sysctl parameters to be set, kernel modules to be loaded, etc; consult the documentation for your specific network implementation.)Enable IPv4 packet forwardingTo manually enable IPv4 packet forwarding:# sysctl params required by setup, params persist across reboots cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf net.ipv4.ip_forward = 1 EOF # Apply sysctl params without reboot sudo sysctl --system Verify that net.ipv4.ip_forward is set to 1 with:sysctl net.ipv4.ip_forward cgroup driversOn Linux, control groups are used to constrain resources that are allocated to processes.Both the kubelet and the underlying container runtime need to interface with control groups to enforce resource management for pods and containers and set resources such as cpu/memory requests and limits. To interface with control groups, the kubelet and the container runtime need to use a cgroup driver. It's critical that the kubelet and the container runtime use the same cgroup driver and are configured the same.There are two cgroup drivers available:cgroupfssystemdcgroupfs driverThe cgroupfs driver is the default cgroup driver in the kubelet. When the cgroupfs driver is used, the kubelet and the container runtime directly interface with the cgroup filesystem to configure cgroups.The cgroupfs driver is not recommended when systemd is the init system because systemd expects a single cgroup manager on the system. Additionally, if you use cgroup v2, use the systemd cgroup driver instead of cgroupfs.systemd cgroup driverW


Question: When would you use Container Runtimes?

Answer: Container RuntimesNote: Dockershim has been removed from the Kubernetes project as of release 1.24. Read the Dockershim Removal FAQ for further details.You need to install a container runtime into each node in the cluster so that Pods can run there. This page outlines what is involved and describes related tasks for setting up nodes.Kubernetes 1.34 requires that you use a runtime that conforms with the Container Runtime Interface (CRI).See CRI version support for more information.This page provides an outline of how to use several common container runtimes with Kubernetes.containerdCRI-ODocker EngineMirantis Container RuntimeNote:Kubernetes releases before v1.24 included a direct integration with Docker Engine, using a component named dockershim. That special direct integration is no longer part of Kubernetes (this removal was announced as part of the v1.20 release). You can read Check whether Dockershim removal affects you to understand how this removal might affect you. To learn about migrating from using dockershim, see Migrating from dockershim.If you are running a version of Kubernetes other than v1.34, check the documentation for that version.Install and configure prerequisitesNetwork configurationBy default, the Linux kernel does not allow IPv4 packets to be routed between interfaces. Most Kubernetes cluster networking implementations will change this setting (if needed), but some might expect the administrator to do it for them. (Some might also expect other sysctl parameters to be set, kernel modules to be loaded, etc; consult the documentation for your specific network implementation.)Enable IPv4 packet forwardingTo manually enable IPv4 packet forwarding:# sysctl params required by setup, params persist across reboots cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf net.ipv4.ip_forward = 1 EOF # Apply sysctl params without reboot sudo sysctl --system Verify that net.ipv4.ip_forward is set to 1 with:sysctl net.ipv4.ip_forward cgroup driversOn Linux, control groups are used to constrain resources that are allocated to processes.Both the kubelet and the underlying container runtime need to interface with control groups to enforce resource management for pods and containers and set resources such as cpu/memory requests and limits. To interface with control groups, the kubelet and the container runtime need to use a cgroup driver. It's critical that the kubelet and the container runtime use the same cgroup driver and are configured the same.There are two cgroup drivers available:cgroupfssystemdcgroupfs driverThe cgroupfs driver is the default cgroup driver in the kubelet. When the cgroupfs driver is used, the kubelet and the container runtime directly interface with the cgroup filesystem to configure cgroups.The cgroupfs driver is not recommended when systemd is the init system because systemd expects a single cgroup manager on the system. Additionally, if you use cgroup v2, use the systemd cgroup driver instead of cgroupfs.systemd cgroup driverW


Question: What are the benefits of Container Runtimes?

Answer: Container RuntimesNote: Dockershim has been removed from the Kubernetes project as of release 1.24. Read the Dockershim Removal FAQ for further details.You need to install a container runtime into each node in the cluster so that Pods can run there. This page outlines what is involved and describes related tasks for setting up nodes.Kubernetes 1.34 requires that you use a runtime that conforms with the Container Runtime Interface (CRI).See CRI version support for more information.This page provides an outline of how to use several common container runtimes with Kubernetes.containerdCRI-ODocker EngineMirantis Container RuntimeNote:Kubernetes releases before v1.24 included a direct integration with Docker Engine, using a component named dockershim. That special direct integration is no longer part of Kubernetes (this removal was announced as part of the v1.20 release). You can read Check whether Dockershim removal affects you to understand how this removal might affect you. To learn about migrating from using dockershim, see Migrating from dockershim.If you are running a version of Kubernetes other than v1.34, check the documentation for that version.Install and configure prerequisitesNetwork configurationBy default, the Linux kernel does not allow IPv4 packets to be routed between interfaces. Most Kubernetes cluster networking implementations will change this setting (if needed), but some might expect the administrator to do it for them. (Some might also expect other sysctl parameters to be set, kernel modules to be loaded, etc; consult the documentation for your specific network implementation.)Enable IPv4 packet forwardingTo manually enable IPv4 packet forwarding:# sysctl params required by setup, params persist across reboots cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf net.ipv4.ip_forward = 1 EOF # Apply sysctl params without reboot sudo sysctl --system Verify that net.ipv4.ip_forward is set to 1 with:sysctl net.ipv4.ip_forward cgroup driversOn Linux, control groups are used to constrain resources that are allocated to processes.Both the kubelet and the underlying container runtime need to interface with control groups to enforce resource management for pods and containers and set resources such as cpu/memory requests and limits. To interface with control groups, the kubelet and the container runtime need to use a cgroup driver. It's critical that the kubelet and the container runtime use the same cgroup driver and are configured the same.There are two cgroup drivers available:cgroupfssystemdcgroupfs driverThe cgroupfs driver is the default cgroup driver in the kubelet. When the cgroupfs driver is used, the kubelet and the container runtime directly interface with the cgroup filesystem to configure cgroups.The cgroupfs driver is not recommended when systemd is the init system because systemd expects a single cgroup manager on the system. Additionally, if you use cgroup v2, use the systemd cgroup driver instead of cgroupfs.systemd cgroup driverW


Question: What is Container Runtimes?

Answer: Y o u   n e e d   t o   i n s t a l l   a   c o n t a i n e r   r u n t i m e   i n t o   e a c h   n o d e   i n   t h e   c l u s t e r   s o   t h a t   P o d s   c a n   r u n   t h e r e .   T h i s   p a g e   o u t l i n e s   w h a t   i s   i n v o l v e d   a n d   d e s c r i b e s   r e l a t e d   t a s k s   f o r   s e t t i n g   u p   n o d e s .   K u b e r n e t e s   1 . 3 4   r e q u i r e s   t h a t   y o u   u s e   a   r u n t i m e   t h a t   c o n f o r m s   w i t h   t h e   C o n t a i n e r   R u n t i m e   I n t e r f a c e   ( C R I ) .   S e e   C R I   v e r s i o n   s u p p o r t   f o r   m o r e   i n f o r m a t i o n .   T h i s   p a g e   p r o v i d e s   a n   o u t l i n e   o f   h o w   t o   u s e   s e v e r a l   c o m m o n   c o n t a i n e r   r u n t i m e s   w i t h   K u b e r n e t e s .   c o n t a i n e r d C R I - O D o c k e r   E n g i n e M i r a n t i s   C o n t a i n e r   R u n t i m e


Question: What is Note:?

Answer: K u b e r n e t e s   r e l e a s e s   b e f o r e   v 1 . 2 4   i n c l u d e d   a   d i r e c t   i n t e g r a t i o n   w i t h   D o c k e r   E n g i n e ,   u s i n g   a   c o m p o n e n t   n a m e d   d o c k e r s h i m .   T h a t   s p e c i a l   d i r e c t   i n t e g r a t i o n   i s   n o   l o n g e r   p a r t   o f   K u b e r n e t e s   ( t h i s   r e m o v a l   w a s   a n n o u n c e d   a s   p a r t   o f   t h e   v 1 . 2 0   r e l e a s e ) .   Y o u   c a n   r e a d   C h e c k   w h e t h e r   D o c k e r s h i m   r e m o v a l   a f f e c t s   y o u   t o   u n d e r s t a n d   h o w   t h i s   r e m o v a l   m i g h t   a f f e c t   y o u .   T o   l e a r n   a b o u t   m i g r a t i n g   f r o m   u s i n g   d o c k e r s h i m ,   s e e   M i g r a t i n g   f r o m   d o c k e r s h i m .   I f   y o u   a r e   r u n n i n g   a   v e r s i o n   o f   K u b e r n e t e s   o t h e r   t h a n   v 1 . 3 4 ,   c h e c k   t h e   d o c u m e n t a t i o n   f o r   t h a t   v e r s i o n .


Question: What is Network configuration?

Answer: B y   d e f a u l t ,   t h e   L i n u x   k e r n e l   d o e s   n o t   a l l o w   I P v 4   p a c k e t s   t o   b e   r o u t e d   b e t w e e n   i n t e r f a c e s .   M o s t   K u b e r n e t e s   c l u s t e r   n e t w o r k i n g   i m p l e m e n t a t i o n s   w i l l   c h a n g e   t h i s   s e t t i n g   ( i f   n e e d e d ) ,   b u t   s o m e   m i g h t   e x p e c t   t h e   a d m i n i s t r a t o r   t o   d o   i t   f o r   t h e m .   ( S o m e   m i g h t   a l s o   e x p e c t   o t h e r   s y s c t l   p a r a m e t e r s   t o   b e   s e t ,   k e r n e l   m o d u l e s   t o   b e   l o a d e d ,   e t c ;   c o n s u l t   t h e   d o c u m e n t a t i o n   f o r   y o u r   s p e c i f i c   n e t w o r k   i m p l e m e n t a t i o n . )


Question: What is Enable IPv4 packet forwarding?

Answer: T o   m a n u a l l y   e n a b l e   I P v 4   p a c k e t   f o r w a r d i n g :   #   s y s c t l   p a r a m s   r e q u i r e d   b y   s e t u p ,   p a r a m s   p e r s i s t   a c r o s s   r e b o o t s   c a t   < < E O F   |   s u d o   t e e   / e t c / s y s c t l . d / k 8 s . c o n f   n e t . i p v 4 . i p _ f o r w a r d   =   1   E O F   #   A p p l y   s y s c t l   p a r a m s   w i t h o u t   r e b o o t   s u d o   s y s c t l   - - s y s t e m   V e r i f y   t h a t   n e t . i p v 4 . i p _ f o r w a r d   i s   s e t   t o   1   w i t h :   s y s c t l   n e t . i p v 4 . i p _ f o r w a r d


Question: What is cgroup drivers?

Answer: O n   L i n u x ,   c o n t r o l   g r o u p s   a r e   u s e d   t o   c o n s t r a i n   r e s o u r c e s   t h a t   a r e   a l l o c a t e d   t o   p r o c e s s e s .   B o t h   t h e   k u b e l e t   a n d   t h e   u n d e r l y i n g   c o n t a i n e r   r u n t i m e   n e e d   t o   i n t e r f a c e   w i t h   c o n t r o l   g r o u p s   t o   e n f o r c e   r e s o u r c e   m a n a g e m e n t   f o r   p o d s   a n d   c o n t a i n e r s   a n d   s e t   r e s o u r c e s   s u c h   a s   c p u / m e m o r y   r e q u e s t s   a n d   l i m i t s .   T o   i n t e r f a c e   w i t h   c o n t r o l   g r o u p s ,   t h e   k u b e l e t   a n d   t h e   c o n t a i n e r   r u n t i m e   n e e d   t o   u s e   a   c g r o u p   d r i v e r .   I t ' s   c r i t i c a l   t h a t   t h e   k u b e l e t   a n d   t h e   c o n t a i n e r   r u n t i m e   u s e   t h e   s a m e   c g r o u p   d r i v e r   a n d   a r e   c o n f i g u r e d   t h e   s a m e .   T h e r e   a r e   t w o   c g r o u p   d r i v e r s   a v a i l a b l e :   c g r o u p f s s y s t e m d


Question: What is cgroupfs driver?

Answer: T h e   c g r o u p f s   d r i v e r   i s   t h e   d e f a u l t   c g r o u p   d r i v e r   i n   t h e   k u b e l e t .   W h e n   t h e   c g r o u p f s   d r i v e r   i s   u s e d ,   t h e   k u b e l e t   a n d   t h e   c o n t a i n e r   r u n t i m e   d i r e c t l y   i n t e r f a c e   w i t h   t h e   c g r o u p   f i l e s y s t e m   t o   c o n f i g u r e   c g r o u p s .   T h e   c g r o u p f s   d r i v e r   i s   n o t   r e c o m m e n d e d   w h e n   s y s t e m d   i s   t h e   i n i t   s y s t e m   b e c a u s e   s y s t e m d   e x p e c t s   a   s i n g l e   c g r o u p   m a n a g e r   o n   t h e   s y s t e m .   A d d i t i o n a l l y ,   i f   y o u   u s e   c g r o u p   v 2 ,   u s e   t h e   s y s t e m d   c g r o u p   d r i v e r   i n s t e a d   o f   c g r o u p f s .


Question: What is systemd cgroup driver?

Answer: W h e n   s y s t e m d   i s   c h o s e n   a s   t h e   i n i t   s y s t e m   f o r   a   L i n u x   d i s t r i b u t i o n ,   t h e   i n i t   p r o c e s s   g e n e r a t e s   a n d   c o n s u m e s   a   r o o t   c o n t r o l   g r o u p   ( c g r o u p )   a n d   a c t s   a s   a   c g r o u p   m a n a g e r .   s y s t e m d   h a s   a   t i g h t   i n t e g r a t i o n   w i t h   c g r o u p s   a n d   a l l o c a t e s   a   c g r o u p   p e r   s y s t e m d   u n i t .   A s   a   r e s u l t ,   i f   y o u   u s e   s y s t e m d   a s   t h e   i n i t   s y s t e m   w i t h   t h e   c g r o u p f s   d r i v e r ,   t h e   s y s t e m   g e t s   t w o   d i f f e r e n t   c g r o u p   m a n a g e r s .   T w o   c g r o u p   m a n a g e r s   r e s u l t   i n   t w o   v i e w s   o f   t h e   a v a i l a b l e   a n d   i n - u s e   r e s o u r c e s   i n   t h e   s y s t e m .   I n   s o m e   c a s e s ,   n o d e s   t h a t   a r e   c o n f i g u r e d   t o   u s e   c g r o u p f s   f o r   t h e   k u b e l e t   a n d   c o n t a i n e r   r u n t i m e ,   b u t   u s e   s y s t e m d   f o r   t h e   r e s t   o f   t h e   p r o c e s s e s   b e c o m e   u n s t a b l e   u n d e r   r e s o u r c e   p r e s s u r e .   T h e   a p p r o a c h   t o   m i t i g a t e   t h i s   i n s t a b i l i t y   i s   t o   u s e   s y s t e m d   a s   t h e   c g r o u p   d r i v e r   f o r   t h e   k u b e l e t   a n d   t h e   c o n t a i n e r   r u n t i m e   w h e n   s y s t e m d   i s   t h e   s e l e c t e d   i n i t   s y s t e m .   T o   s e t   s y s t e m d   a s   t h e   c g r o u p   d r i v e r ,   e d i t   t h e   K u b e l e t C o n f i g u r a t i o n   o p t i o n   o f   c g r o u p D r i v e r   a n d   s e t   i t   t o   s y s t e m d .   F o r   e x a m p l e :   a p i V e r s i o n :   k u b e l e t . c o n f i g . k 8 s . i o / v 1 b e t a 1   k i n d :   K u b e l e t


Question: What is Note:?

Answer: I f   y o u   c o n f i g u r e   s y s t e m d   a s   t h e   c g r o u p   d r i v e r   f o r   t h e   k u b e l e t ,   y o u   m u s t   a l s o   c o n f i g u r e   s y s t e m d   a s   t h e   c g r o u p   d r i v e r   f o r   t h e   c o n t a i n e r   r u n t i m e .   R e f e r   t o   t h e   d o c u m e n t a t i o n   f o r   y o u r   c o n t a i n e r   r u n t i m e   f o r   i n s t r u c t i o n s .   F o r   e x a m p l e :   c o n t a i n e r d C R I - O   I n   K u b e r n e t e s   1 . 3 4 ,   w i t h   t h e   K u b e l e t C g r o u p D r i v e r F r o m C R I   f e a t u r e   g a t e   e n a b l e d   a n d   a   c o n t a i n e r   r u n t i m e   t h a t   s u p p o r t s   t h e   R u n t i m e C o n f i g   C R I   R P C ,   t h e   k u b e l e t   a u t o m a t i c a l l y   d e t e c t s   t h e   a p p r o p r i a t e   c g r o u p   d r i v e r   f r o m   t h e   r u n t i m e ,   a n d   i g n o r e s   t h e   c g r o u p D r i v e r   s e t t i n g   w i t h i n   t h e   k u b e l e t   c o n f i g u r a t i o n .   H o w e v e r ,   o l d e r   v e r s i o n s   o f   c o n t a i n e r   r u n t i m e s   ( s p e c i f i c a l l y ,   c o n t a i n e r d   1 . y   a n d   b e l o w )   d o   n o t   s u p p o r t   t h e   R u n t i m e C o n f i g   C R I   R P C ,   a n d   m a y   n o t   r e s p o n d   c o r r e c t l y   t o   t h i s   q u e r y ,   a n d   t h u s   t h e   K u b e l e t   f a l l s   b a c k   t o   u s i n g   t h e   v a l u e   i n   i t s   o w n   - - c g r o u p - d r i v e r   f l a g .   I n   K u b e r n e t e s   1 . 3 6 ,   t h i s   f a l l b a c k   b e h a v i o r   w i l l   b e   d r o p p e d ,   a n d   o l d e r   v e r s i o n s   o f   c o n t a i n e r d   w i l l   f a i l   w i t h   n e w e r   k u b e l e t s .


Question: What is Caution:?

Answer: C h a n g i n g   t h e   c g r o u p   d r i v e r   o f   a   N o d e   t h a t   h a s   j o i n e d   a   c l u s t e r   i s   a   s e n s i t i v e   o p e r a t i o n .   I f   t h e   k u b e l e t   h a s   c r e a t e d   P o d s   u s i n g   t h e   s e m a n t i c s   o f   o n e   c g r o u p   d r i v e r ,   c h a n g i n g   t h e   c o n t a i n e r   r u n t i m e   t o   a n o t h e r   c g r o u p   d r i v e r   c a n   c a u s e   e r r o r s   w h e n   t r y i n g   t o   r e - c r e a t e   t h e   P o d   s a n d b o x   f o r   s u c h   e x i s t i n g   P o d s .   R e s t a r t i n g   t h e   k u b e l e t   m a y   n o t   s o l v e   s u c h   e r r o r s .   I f   y o u   h a v e   a u t o m a t i o n   t h a t   m a k e s   i t   f e a s i b l e ,   r e p l a c e   t h e   n o d e   w i t h   a n o t h e r   u s i n g   t h e   u p d a t e d   c o n f i g u r a t i o n ,   o r   r e i n s t a l l   i t   u s i n g   a u t o m a t i o n .


Question: What is Migrating to the systemd driver in kubeadm managed clusters?

Answer: I f   y o u   w i s h   t o   m i g r a t e   t o   t h e   s y s t e m d   c g r o u p   d r i v e r   i n   e x i s t i n g   k u b e a d m   m a n a g e d   c l u s t e r s ,   f o l l o w   c o n f i g u r i n g   a   c g r o u p   d r i v e r .


Question: What is CRI version support?

Answer: Y o u r   c o n t a i n e r   r u n t i m e   m u s t   s u p p o r t   a t   l e a s t   v 1 a l p h a 2   o f   t h e   c o n t a i n e r   r u n t i m e   i n t e r f a c e .   K u b e r n e t e s   s t a r t i n g   v 1 . 2 6   o n l y   w o r k s   w i t h   v 1   o f   t h e   C R I   A P I .   E a r l i e r   v e r s i o n s   d e f a u l t   t o   v 1   v e r s i o n ,   h o w e v e r   i f   a   c o n t a i n e r   r u n t i m e   d o e s   n o t   s u p p o r t   t h e   v 1   A P I ,   t h e   k u b e l e t   f a l l s   b a c k   t o   u s i n g   t h e   ( d e p r e c a t e d )   v 1 a l p h a 2   A P I   i n s t e a d .


Question: What is containerd?

Answer: T h i s   s e c t i o n   o u t l i n e s   t h e   n e c e s s a r y   s t e p s   t o   u s e   c o n t a i n e r d   a s   C R I   r u n t i m e .   T o   i n s t a l l   c o n t a i n e r d   o n   y o u r   s y s t e m ,   f o l l o w   t h e   i n s t r u c t i o n s   o n   g e t t i n g   s t a r t e d   w i t h   c o n t a i n e r d .   R e t u r n   t o   t h i s   s t e p   o n c e   y o u ' v e   c r e a t e d   a   v a l i d   c o n f i g . t o m l   c o n f i g u r a t i o n   f i l e .   Y o u   c a n   f i n d   t h i s   f i l e   u n d e r   t h e   p a t h   / e t c / c o n t a i n e r d / c o n f i g . t o m l .   Y o u   c a n   f i n d   t h i s   f i l e   u n d e r   t h e   p a t h   / e t c / c o n t a i n e r d / c o n f i g . t o m l .   Y o u   c a n   f i n d   t h i s   f i l e   u n d e r   t h e   p a t h   C : \ P r o g r a m   F i l e s \ c o n t a i n e r d \ c o n f i g . t o m l .   Y o u   c a n   f i n d   t h i s   f i l e   u n d e r   t h e   p a t h   C : \ P r o g r a m   F i l e s \ c o n t a i n e r d \ c o n f i g . t o m l .   O n   L i n u x   t h e   d e f a u l t   C R I   s o c k e t   f o r   c o n t a i n e r d   i s   / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k .   O n   W i n d o w s   t h e   d e f a u l t   C R I   e n d p o i n t   i s   n p i p e : / / . / p i p e / c o n t a i n e r d - c o n t a i n e r d .


Question: What is Configuring the systemd cgroup driver?

Answer: T o   u s e   t h e   s y s t e m d   c g r o u p   d r i v e r   i n   / e t c / c o n t a i n e r d / c o n f i g . t o m l   w i t h   r u n c ,   s e t   t h e   f o l l o w i n g   c o n f i g   b a s e d   o n   y o u r   C o n t a i n e r d   v e r s i o n   C o n t a i n e r d   v e r s i o n s   1 . x :   [ p l u g i n s . " i o . c o n t a i n e r d . g r p c . v 1 . c r i " . c o n t a i n e r d . r u n t i m e s . r u n c ]   . . .   [ p l u g i n s . " i o . c o n t a i n e r d . g r p c . v 1 . c r i " . c o n t a i n e r d . r u n t i m e s . r u n c . o p t i o n s ]   S y s t e m d C g r o u p   =   t r u e   C o n t a i n e r d   v e r s i o n s   2 . x :   [ p l u g i n s . ' i o . c o n t a i n e r d . c r i . v 1 . r u n t i m e ' . c o n t a i n e r d . r u n t i m e s . r u n c ]   . . .   [ p l u g i n s . ' i o . c o n t a i n e r d . c r i . v 1 . r u n t i m e ' . c o n t a i n e r d . r u n t i m e s . r u n c . o p t i o n s ]   S y s t e m d C g r o u p   =   t r u e   T h e   s y s t e m d   c g r o u p   d r i v e r   i s   r e c o m m e n d e d   i f   y o u   u s e   c g r o u p   v 2 .


Question: What is Note:?

Answer: I f   y o u   i n s t a l l e d   c o n t a i n e r d   f r o m   a   p a c k a g e   ( f o r   e x a m p l e ,   R P M   o r   . d e b ) ,   y o u   m a y   f i n d   t h a t   t h e   C R I   i n t e g r a t i o n   p l u g i n   i s   d i s a b l e d   b y   d e f a u l t .   Y o u   n e e d   C R I   s u p p o r t   e n a b l e d   t o   u s e   c o n t a i n e r d   w i t h   K u b e r n e t e s .   M a k e   s u r e   t h a t   c r i   i s   n o t   i n c l u d e d   i n   t h e d i s a b l e d _ p l u g i n s   l i s t   w i t h i n   / e t c / c o n t a i n e r d / c o n f i g . t o m l ;   i f   y o u   m a d e   c h a n g e s   t o   t h a t   f i l e ,   a l s o   r e s t a r t   c o n t a i n e r d .   I f   y o u   e x p e r i e n c e   c o n t a i n e r   c r a s h   l o o p s   a f t e r   t h e   i n i t i a l   c l u s t e r   i n s t a l l a t i o n   o r   a f t e r   i n s t a l l i n g   a   C N I ,   t h e   c o n t a i n e r d   c o n f i g u r a t i o n   p r o v i d e d   w i t h   t h e   p a c k a g e   m i g h t   c o n t a i n   i n c o m p a t i b l e   c o n f i g u r a t i o n   p a r a m e t e r s .   C o n s i d e r   r e s e t t i n g   t h e   c o n t a i n e r d   c o n f i g u r a t i o n   w i t h   c o n t a i n e r d   c o n f i g   d e f a u l t   >   / e t c / c o n t a i n e r d / c o n f i g . t o m l   a s   s p e c i f i e d   i n   g e t t i n g - s t a r t e d . m d   a n d   t h e n   s e t   t h e   c o n f i g u r a t i o n   p a r a m e t e r s   s p e c i f i e d   a b o v e   a c c o r d i n g l y .   I f   y o u   a p p l y   t h i s   c h a n g e ,   m a k e   s u r e   t o   r e s t a r t   c o n t a i n e r d :   s u d o   s y s t e m c t l   r e s t a r t   c o n t a i n e r d   W h e n   u s i n g   k u b e a d m ,   m a n u a l l y   c o n f i g u r e   t h e   c g r o u p   d r i v e r   f o r   k u b e l e t .   I n   K u b e r n e t e s   v 1 . 2 8 ,   y o u   c a n   e n a b l e   a u t o m a t i c


Question: What is Overriding the sandbox (pause) image?

Answer: I n   y o u r   c o n t a i n e r d   c o n f i g   y o u   c a n   o v e r w r i t e   t h e   s a n d b o x   i m a g e   b y   s e t t i n g   t h e   f o l l o w i n g   c o n f i g :   [ p l u g i n s . " i o . c o n t a i n e r d . g r p c . v 1 . c r i " ]   s a n d b o x _ i m a g e   =   " r e g i s t r y . k 8 s . i o / p a u s e : 3 . 1 0 "   Y o u   m i g h t   n e e d   t o   r e s t a r t   c o n t a i n e r d   a s   w e l l   o n c e   y o u ' v e   u p d a t e d   t h e   c o n f i g   f i l e :   s y s t e m c t l   r e s t a r t   c o n t a i n e r d .


Question: What is CRI-O?

Answer: T h i s   s e c t i o n   c o n t a i n s   t h e   n e c e s s a r y   s t e p s   t o   i n s t a l l   C R I - O   a s   a   c o n t a i n e r   r u n t i m e .   T o   i n s t a l l   C R I - O ,   f o l l o w   C R I - O   I n s t a l l   I n s t r u c t i o n s .


Question: What is cgroup driver?

Answer: C R I - O   u s e s   t h e   s y s t e m d   c g r o u p   d r i v e r   p e r   d e f a u l t ,   w h i c h   i s   l i k e l y   t o   w o r k   f i n e   f o r   y o u .   T o   s w i t c h   t o   t h e   c g r o u p f s   c g r o u p   d r i v e r ,   e i t h e r   e d i t   / e t c / c r i o / c r i o . c o n f   o r   p l a c e   a   d r o p - i n   c o n f i g u r a t i o n   i n   / e t c / c r i o / c r i o . c o n f . d / 0 2 - c g r o u p - m a n a g e r . c o n f ,   f o r   e x a m p l e :   [ c r i o . r u n t i m e ]   c o n m o n _ c g r o u p   =   " p o d "   c g r o u p _ m a n a g e r   =   " c g r o u p f s "   Y o u   s h o u l d   a l s o   n o t e   t h e   c h a n g e d   c o n m o n _ c g r o u p ,   w h i c h   h a s   t o   b e   s e t   t o   t h e   v a l u e   p o d   w h e n   u s i n g   C R I - O   w i t h   c g r o u p f s .   I t   i s   g e n e r a l l y   n e c e s s a r y   t o   k e e p   t h e   c g r o u p   d r i v e r   c o n f i g u r a t i o n   o f   t h e   k u b e l e t   ( u s u a l l y   d o n e   v i a   k u b e a d m )   a n d   C R I - O   i n   s y n c .   I n   K u b e r n e t e s   v 1 . 2 8 ,   y o u   c a n   e n a b l e   a u t o m a t i c   d e t e c t i o n   o f   t h e   c g r o u p   d r i v e r   a s   a n   a l p h a   f e a t u r e .   S e e   s y s t e m d   c g r o u p   d r i v e r   f o r   m o r e   d e t a i l s .   F o r   C R I - O ,   t h e   C R I   s o c k e t   i s   / v a r / r u n / c r i o / c r i o . s o c k   b y   d e f a u l t .


Question: What is Overriding the sandbox (pause) image?

Answer: I n   y o u r   C R I - O   c o n f i g   y o u   c a n   s e t   t h e   f o l l o w i n g   c o n f i g   v a l u e :   [ c r i o . i m a g e ]   p a u s e _ i m a g e = " r e g i s t r y . k 8 s . i o / p a u s e : 3 . 1 0 "   T h i s   c o n f i g   o p t i o n   s u p p o r t s   l i v e   c o n f i g u r a t i o n   r e l o a d   t o   a p p l y   t h i s   c h a n g e :   s y s t e m c t l   r e l o a d   c r i o   o r   b y   s e n d i n g   S I G H U P   t o   t h e   c r i o   p r o c e s s .


Question: What is Note:?

Answer: O n   e a c h   o f   y o u r   n o d e s ,   i n s t a l l   D o c k e r   f o r   y o u r   L i n u x   d i s t r i b u t i o n   a s   p e r   I n s t a l l   D o c k e r   E n g i n e . I n s t a l l   c r i - d o c k e r d ,   f o l l o w i n g   t h e   d i r e c t i o n s   i n   t h e   i n s t a l l   s e c t i o n   o f   t h e   d o c u m e n t a t i o n .   O n   e a c h   o f   y o u r   n o d e s ,   i n s t a l l   D o c k e r   f o r   y o u r   L i n u x   d i s t r i b u t i o n   a s   p e r   I n s t a l l   D o c k e r   E n g i n e .   I n s t a l l   c r i - d o c k e r d ,   f o l l o w i n g   t h e   d i r e c t i o n s   i n   t h e   i n s t a l l   s e c t i o n   o f   t h e   d o c u m e n t a t i o n .   F o r   c r i - d o c k e r d ,   t h e   C R I   s o c k e t   i s   / r u n / c r i - d o c k e r d . s o c k   b y   d e f a u l t .


Question: What is Mirantis Container Runtime?

Answer: M i r a n t i s   C o n t a i n e r   R u n t i m e   ( M C R )   i s   a   c o m m e r c i a l l y   a v a i l a b l e   c o n t a i n e r   r u n t i m e   t h a t   w a s   f o r m e r l y   k n o w n   a s   D o c k e r   E n t e r p r i s e   E d i t i o n .   Y o u   c a n   u s e   M i r a n t i s   C o n t a i n e r   R u n t i m e   w i t h   K u b e r n e t e s   u s i n g   t h e   o p e n   s o u r c e   c r i - d o c k e r d   c o m p o n e n t ,   i n c l u d e d   w i t h   M C R .   T o   l e a r n   m o r e   a b o u t   h o w   t o   i n s t a l l   M i r a n t i s   C o n t a i n e r   R u n t i m e ,   v i s i t   M C R   D e p l o y m e n t   G u i d e .   C h e c k   t h e   s y s t e m d   u n i t   n a m e d   c r i - d o c k e r . s o c k e t   t o   f i n d   o u t   t h e   p a t h   t o   t h e   C R I   s o c k e t .


Question: What is Overriding the sandbox (pause) image?

Answer: T h e   c r i - d o c k e r d   a d a p t e r   a c c e p t s   a   c o m m a n d   l i n e   a r g u m e n t   f o r   s p e c i f y i n g   w h i c h   c o n t a i n e r   i m a g e   t o   u s e   a s   t h e   P o d   i n f r a s t r u c t u r e   c o n t a i n e r   ( “ p a u s e   i m a g e ” ) .   T h e   c o m m a n d   l i n e   a r g u m e n t   t o   u s e   i s   - - p o d - i n f r a - c o n t a i n e r - i m a g e .


Question: What is What's next?

Answer: A s   w e l l   a s   a   c o n t a i n e r   r u n t i m e ,   y o u r   c l u s t e r   w i l l   n e e d   a   w o r k i n g   n e t w o r k   p l u g i n .   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Volume Snapshot Classes?

Answer: Volume Snapshot ClassesThis document describes the concept of VolumeSnapshotClass in Kubernetes. Familiarity with volume snapshots and storage classes is suggested.IntroductionJust like StorageClass provides a way for administrators to describe the "classes" of storage they offer when provisioning a volume, VolumeSnapshotClass provides a way to describe the "classes" of storage when provisioning a volume snapshot.The VolumeSnapshotClass ResourceEach VolumeSnapshotClass contains the fields driver, deletionPolicy, and parameters, which are used when a VolumeSnapshot belonging to the class needs to be dynamically provisioned.The name of a VolumeSnapshotClass object is significant, and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeSnapshotClass objects, and the objects cannot be updated once they are created.Note:Installation of the CRDs is the responsibility of the Kubernetes distribution. Without the required CRDs present, the creation of a VolumeSnapshotClass fails.apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: Administrators can specify a default VolumeSnapshotClass for VolumeSnapshots that don't request any particular class to bind to by adding the snapshot.storage.kubernetes.io/is-default-class: "true" annotation:apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass annotations: snapshot.storage.kubernetes.io/is-default-class: "true" driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: If multiple CSI drivers exist, a default VolumeSnapshotClass can be specified for each of them.VolumeSnapshotClass dependenciesWhen you create a VolumeSnapshot without specifying a VolumeSnapshotClass, Kubernetes automatically selects a default VolumeSnapshotClass that has a CSI driver matching the CSI driver of the PVC’s StorageClass.This behavior allows multiple default VolumeSnapshotClass objects to coexist in a cluster, as long as each one is associated with a unique CSI driver.Always ensure that there is only one default VolumeSnapshotClass for each CSI driver. If multiple default VolumeSnapshotClass objects are created using the same CSI driver, a VolumeSnapshot creation will fail because Kubernetes cannot determine which one to use.DriverVolume snapshot classes have a driver that determines what CSI volume plugin is used for provisioning VolumeSnapshots. This field must be specified.DeletionPolicyVolume snapshot classes have a deletionPolicy. It enables you to configure what happens to a VolumeSnapshotContent when the VolumeSnapshot object it is bound to is to be deleted. The deletionPolicy of a volume snapshot class can either be Retain or Delete. This field must be specified.If the deletionPolicy is Delete, then the underlying storage snapshot will be deleted along with the VolumeSnapshotConten


Question: How does Volume Snapshot Classes work?

Answer: Volume Snapshot ClassesThis document describes the concept of VolumeSnapshotClass in Kubernetes. Familiarity with volume snapshots and storage classes is suggested.IntroductionJust like StorageClass provides a way for administrators to describe the "classes" of storage they offer when provisioning a volume, VolumeSnapshotClass provides a way to describe the "classes" of storage when provisioning a volume snapshot.The VolumeSnapshotClass ResourceEach VolumeSnapshotClass contains the fields driver, deletionPolicy, and parameters, which are used when a VolumeSnapshot belonging to the class needs to be dynamically provisioned.The name of a VolumeSnapshotClass object is significant, and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeSnapshotClass objects, and the objects cannot be updated once they are created.Note:Installation of the CRDs is the responsibility of the Kubernetes distribution. Without the required CRDs present, the creation of a VolumeSnapshotClass fails.apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: Administrators can specify a default VolumeSnapshotClass for VolumeSnapshots that don't request any particular class to bind to by adding the snapshot.storage.kubernetes.io/is-default-class: "true" annotation:apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass annotations: snapshot.storage.kubernetes.io/is-default-class: "true" driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: If multiple CSI drivers exist, a default VolumeSnapshotClass can be specified for each of them.VolumeSnapshotClass dependenciesWhen you create a VolumeSnapshot without specifying a VolumeSnapshotClass, Kubernetes automatically selects a default VolumeSnapshotClass that has a CSI driver matching the CSI driver of the PVC’s StorageClass.This behavior allows multiple default VolumeSnapshotClass objects to coexist in a cluster, as long as each one is associated with a unique CSI driver.Always ensure that there is only one default VolumeSnapshotClass for each CSI driver. If multiple default VolumeSnapshotClass objects are created using the same CSI driver, a VolumeSnapshot creation will fail because Kubernetes cannot determine which one to use.DriverVolume snapshot classes have a driver that determines what CSI volume plugin is used for provisioning VolumeSnapshots. This field must be specified.DeletionPolicyVolume snapshot classes have a deletionPolicy. It enables you to configure what happens to a VolumeSnapshotContent when the VolumeSnapshot object it is bound to is to be deleted. The deletionPolicy of a volume snapshot class can either be Retain or Delete. This field must be specified.If the deletionPolicy is Delete, then the underlying storage snapshot will be deleted along with the VolumeSnapshotConten


Question: When would you use Volume Snapshot Classes?

Answer: Volume Snapshot ClassesThis document describes the concept of VolumeSnapshotClass in Kubernetes. Familiarity with volume snapshots and storage classes is suggested.IntroductionJust like StorageClass provides a way for administrators to describe the "classes" of storage they offer when provisioning a volume, VolumeSnapshotClass provides a way to describe the "classes" of storage when provisioning a volume snapshot.The VolumeSnapshotClass ResourceEach VolumeSnapshotClass contains the fields driver, deletionPolicy, and parameters, which are used when a VolumeSnapshot belonging to the class needs to be dynamically provisioned.The name of a VolumeSnapshotClass object is significant, and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeSnapshotClass objects, and the objects cannot be updated once they are created.Note:Installation of the CRDs is the responsibility of the Kubernetes distribution. Without the required CRDs present, the creation of a VolumeSnapshotClass fails.apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: Administrators can specify a default VolumeSnapshotClass for VolumeSnapshots that don't request any particular class to bind to by adding the snapshot.storage.kubernetes.io/is-default-class: "true" annotation:apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass annotations: snapshot.storage.kubernetes.io/is-default-class: "true" driver: hostpath.csi.k8s.io deletionPolicy: Delete parameters: If multiple CSI drivers exist, a default VolumeSnapshotClass can be specified for each of them.VolumeSnapshotClass dependenciesWhen you create a VolumeSnapshot without specifying a VolumeSnapshotClass, Kubernetes automatically selects a default VolumeSnapshotClass that has a CSI driver matching the CSI driver of the PVC’s StorageClass.This behavior allows multiple default VolumeSnapshotClass objects to coexist in a cluster, as long as each one is associated with a unique CSI driver.Always ensure that there is only one default VolumeSnapshotClass for each CSI driver. If multiple default VolumeSnapshotClass objects are created using the same CSI driver, a VolumeSnapshot creation will fail because Kubernetes cannot determine which one to use.DriverVolume snapshot classes have a driver that determines what CSI volume plugin is used for provisioning VolumeSnapshots. This field must be specified.DeletionPolicyVolume snapshot classes have a deletionPolicy. It enables you to configure what happens to a VolumeSnapshotContent when the VolumeSnapshot object it is bound to is to be deleted. The deletionPolicy of a volume snapshot class can either be Retain or Delete. This field must be specified.If the deletionPolicy is Delete, then the underlying storage snapshot will be deleted along with the VolumeSnapshotConten