Question: What are the benefits of Volume Snapshots?

Answer: Volume SnapshotsIn Kubernetes, a VolumeSnapshot represents a snapshot of a volume on a storage system. This document assumes that you are already familiar with Kubernetes persistent volumes.IntroductionSimilar to how API resources PersistentVolume and PersistentVolumeClaim are used to provision volumes for users and administrators, VolumeSnapshotContent and VolumeSnapshot API resources are provided to create volume snapshots for users and administrators.A VolumeSnapshotContent is a snapshot taken from a volume in the cluster that has been provisioned by an administrator. It is a resource in the cluster just like a PersistentVolume is a cluster resource.A VolumeSnapshot is a request for snapshot of a volume by a user. It is similar to a PersistentVolumeClaim.VolumeSnapshotClass allows you to specify different attributes belonging to a VolumeSnapshot. These attributes may differ among snapshots taken from the same volume on the storage system and therefore cannot be expressed by using the same StorageClass of a PersistentVolumeClaim.Volume snapshots provide Kubernetes users with a standardized way to copy a volume's contents at a particular point in time without creating an entirely new volume. This functionality enables, for example, database administrators to backup databases before performing edit or delete modifications.Users need to be aware of the following when using this feature:API Objects VolumeSnapshot, VolumeSnapshotContent, and VolumeSnapshotClass are CRDs, not part of the core API.VolumeSnapshot support is only available for CSI drivers.As part of the deployment process of VolumeSnapshot, the Kubernetes team provides a snapshot controller to be deployed into the control plane, and a sidecar helper container called csi-snapshotter to be deployed together with the CSI driver. The snapshot controller watches VolumeSnapshot and VolumeSnapshotContent objects and is responsible for the creation and deletion of VolumeSnapshotContent object. The sidecar csi-snapshotter watches VolumeSnapshotContent objects and triggers CreateSnapshot and DeleteSnapshot operations against a CSI endpoint.There is also a validating webhook server which provides tightened validation on snapshot objects. This should be installed by the Kubernetes distros along with the snapshot controller and CRDs, not CSI drivers. It should be installed in all Kubernetes clusters that has the snapshot feature enabled.CSI drivers may or may not have implemented the volume snapshot functionality. The CSI drivers that have provided support for volume snapshot will likely use the csi-snapshotter. See CSI Driver documentation for details.The CRDs and snapshot controller installations are the responsibility of the Kubernetes distribution.For advanced use cases, such as creating group snapshots of multiple volumes, see the external CSI Volume Group Snapshot documentation.Lifecycle of a volume snapshot and volume snapshot contentVolumeSnapshotContents are resources in the cluster. Volume


Question: What is Volume Snapshots?

Answer: I n   K u b e r n e t e s ,   a   V o l u m e S n a p s h o t   r e p r e s e n t s   a   s n a p s h o t   o f   a   v o l u m e   o n   a   s t o r a g e   s y s t e m .   T h i s   d o c u m e n t   a s s u m e s   t h a t   y o u   a r e   a l r e a d y   f a m i l i a r   w i t h   K u b e r n e t e s   p e r s i s t e n t   v o l u m e s .


Question: What is Introduction?

Answer: S i m i l a r   t o   h o w   A P I   r e s o u r c e s   P e r s i s t e n t V o l u m e   a n d   P e r s i s t e n t V o l u m e C l a i m   a r e   u s e d   t o   p r o v i s i o n   v o l u m e s   f o r   u s e r s   a n d   a d m i n i s t r a t o r s ,   V o l u m e S n a p s h o t C o n t e n t   a n d   V o l u m e S n a p s h o t   A P I   r e s o u r c e s   a r e   p r o v i d e d   t o   c r e a t e   v o l u m e   s n a p s h o t s   f o r   u s e r s   a n d   a d m i n i s t r a t o r s .   A   V o l u m e S n a p s h o t C o n t e n t   i s   a   s n a p s h o t   t a k e n   f r o m   a   v o l u m e   i n   t h e   c l u s t e r   t h a t   h a s   b e e n   p r o v i s i o n e d   b y   a n   a d m i n i s t r a t o r .   I t   i s   a   r e s o u r c e   i n   t h e   c l u s t e r   j u s t   l i k e   a   P e r s i s t e n t V o l u m e   i s   a   c l u s t e r   r e s o u r c e .   A   V o l u m e S n a p s h o t   i s   a   r e q u e s t   f o r   s n a p s h o t   o f   a   v o l u m e   b y   a   u s e r .   I t   i s   s i m i l a r   t o   a   P e r s i s t e n t V o l u m e C l a i m .   V o l u m e S n a p s h o t C l a s s   a l l o w s   y o u   t o   s p e c i f y   d i f f e r e n t   a t t r i b u t e s   b e l o n g i n g   t o   a   V o l u m e S n a p s h o t .   T h e s e   a t t r i b u t e s   m a y   d i f f e r   a m o n g   s n a p s h o t s   t a k e n   f r o m   t h e   s a m e   v o l u m e   o n   t h e   s t o r a g e   s y s t e m   a n d   t h e r e f o r e   c a n n o t   b e   e x p r e s s e d   b y   u s i n g   t h e   s a m e   S t o r a g e C l a s s   o f   a   P e r s i s t e n t V o l u m e C l a i m .   V o l u m e   s n a p s h o t s   p r o v i d e   K u b e r n e t e s   u s e r s   w i t h   a   s t a n d a r d i z e d   w a y   t o   c o p y   a   v o l u m e ' s   c o n t e n t s   a t   a   p a r t i c u l a r   p o i n t   i n   t i m e   w i t h o u t   c r e a t i n g   a n   e n t i r e l


Question: What is Lifecycle of a volume snapshot and volume snapshot content?

Answer: V o l u m e S n a p s h o t C o n t e n t s   a r e   r e s o u r c e s   i n   t h e   c l u s t e r .   V o l u m e S n a p s h o t s   a r e   r e q u e s t s   f o r   t h o s e   r e s o u r c e s .   T h e   i n t e r a c t i o n   b e t w e e n   V o l u m e S n a p s h o t C o n t e n t s   a n d   V o l u m e S n a p s h o t s   f o l l o w   t h i s   l i f e c y c l e :


Question: What is Provisioning Volume Snapshot?

Answer: T h e r e   a r e   t w o   w a y s   s n a p s h o t s   m a y   b e   p r o v i s i o n e d :   p r e - p r o v i s i o n e d   o r   d y n a m i c a l l y   p r o v i s i o n e d .


Question: What is Pre-provisioned?

Answer: A   c l u s t e r   a d m i n i s t r a t o r   c r e a t e s   a   n u m b e r   o f   V o l u m e S n a p s h o t C o n t e n t s .   T h e y   c a r r y   t h e   d e t a i l s   o f   t h e   r e a l   v o l u m e   s n a p s h o t   o n   t h e   s t o r a g e   s y s t e m   w h i c h   i s   a v a i l a b l e   f o r   u s e   b y   c l u s t e r   u s e r s .   T h e y   e x i s t   i n   t h e   K u b e r n e t e s   A P I   a n d   a r e   a v a i l a b l e   f o r   c o n s u m p t i o n .


Question: What is Dynamic?

Answer: I n s t e a d   o f   u s i n g   a   p r e - e x i s t i n g   s n a p s h o t ,   y o u   c a n   r e q u e s t   t h a t   a   s n a p s h o t   t o   b e   d y n a m i c a l l y   t a k e n   f r o m   a   P e r s i s t e n t V o l u m e C l a i m .   T h e   V o l u m e S n a p s h o t C l a s s   s p e c i f i e s   s t o r a g e   p r o v i d e r - s p e c i f i c   p a r a m e t e r s   t o   u s e   w h e n   t a k i n g   a   s n a p s h o t .


Question: What is Binding?

Answer: T h e   s n a p s h o t   c o n t r o l l e r   h a n d l e s   t h e   b i n d i n g   o f   a   V o l u m e S n a p s h o t   o b j e c t   w i t h   a n   a p p r o p r i a t e   V o l u m e S n a p s h o t C o n t e n t   o b j e c t ,   i n   b o t h   p r e - p r o v i s i o n e d   a n d   d y n a m i c a l l y   p r o v i s i o n e d   s c e n a r i o s .   T h e   b i n d i n g   i s   a   o n e - t o - o n e   m a p p i n g .   I n   t h e   c a s e   o f   p r e - p r o v i s i o n e d   b i n d i n g ,   t h e   V o l u m e S n a p s h o t   w i l l   r e m a i n   u n b o u n d   u n t i l   t h e   r e q u e s t e d   V o l u m e S n a p s h o t C o n t e n t   o b j e c t   i s   c r e a t e d .


Question: What is Persistent Volume Claim as Snapshot Source Protection?

Answer: T h e   p u r p o s e   o f   t h i s   p r o t e c t i o n   i s   t o   e n s u r e   t h a t   i n - u s e   P e r s i s t e n t V o l u m e C l a i m   A P I   o b j e c t s   a r e   n o t   r e m o v e d   f r o m   t h e   s y s t e m   w h i l e   a   s n a p s h o t   i s   b e i n g   t a k e n   f r o m   i t   ( a s   t h i s   m a y   r e s u l t   i n   d a t a   l o s s ) .   W h i l e   a   s n a p s h o t   i s   b e i n g   t a k e n   o f   a   P e r s i s t e n t V o l u m e C l a i m ,   t h a t   P e r s i s t e n t V o l u m e C l a i m   i s   i n - u s e .   I f   y o u   d e l e t e   a   P e r s i s t e n t V o l u m e C l a i m   A P I   o b j e c t   i n   a c t i v e   u s e   a s   a   s n a p s h o t   s o u r c e ,   t h e   P e r s i s t e n t V o l u m e C l a i m   o b j e c t   i s   n o t   r e m o v e d   i m m e d i a t e l y .   I n s t e a d ,   r e m o v a l   o f   t h e   P e r s i s t e n t V o l u m e C l a i m   o b j e c t   i s   p o s t p o n e d   u n t i l   t h e   s n a p s h o t   i s   r e a d y T o U s e   o r   a b o r t e d .


Question: What is Delete?

Answer: D e l e t i o n   i s   t r i g g e r e d   b y   d e l e t i n g   t h e   V o l u m e S n a p s h o t   o b j e c t ,   a n d   t h e   D e l e t i o n P o l i c y   w i l l   b e   f o l l o w e d .   I f   t h e   D e l e t i o n P o l i c y   i s   D e l e t e ,   t h e n   t h e   u n d e r l y i n g   s t o r a g e   s n a p s h o t   w i l l   b e   d e l e t e d   a l o n g   w i t h   t h e   V o l u m e S n a p s h o t C o n t e n t   o b j e c t .   I f   t h e   D e l e t i o n P o l i c y   i s   R e t a i n ,   t h e n   b o t h   t h e   u n d e r l y i n g   s n a p s h o t   a n d   V o l u m e S n a p s h o t C o n t e n t   r e m a i n .


Question: What is VolumeSnapshots?

Answer: E a c h   V o l u m e S n a p s h o t   c o n t a i n s   a   s p e c   a n d   a   s t a t u s .   a p i V e r s i o n :   s n a p s h o t . s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e S n a p s h o t   m e t a d a t a :   n a m e :   n e w - s n a p s h o t - t e s t   s p e c :   v o l u m e S n a p s h o t C l a s s N a m e :   c s i - h o s t p a t h - s n a p c l a s s   s o u r c e :   p e r s i s t e n t V o l u m e C l a i m N a m e :   p v c - t e s t   p e r s i s t e n t V o l u m e C l a i m N a m e   i s   t h e   n a m e   o f   t h e   P e r s i s t e n t V o l u m e C l a i m   d a t a   s o u r c e   f o r   t h e   s n a p s h o t .   T h i s   f i e l d   i s   r e q u i r e d   f o r   d y n a m i c a l l y   p r o v i s i o n i n g   a   s n a p s h o t .   A   v o l u m e   s n a p s h o t   c a n   r e q u e s t   a   p a r t i c u l a r   c l a s s   b y   s p e c i f y i n g   t h e   n a m e   o f   a   V o l u m e S n a p s h o t C l a s s   u s i n g   t h e   a t t r i b u t e   v o l u m e S n a p s h o t C l a s s N a m e .   I f   n o t h i n g   i s   s e t ,   t h e n   t h e   d e f a u l t   c l a s s   i s   u s e d   i f   a v a i l a b l e .   F o r   p r e - p r o v i s i o n e d   s n a p s h o t s ,   y o u   n e e d   t o   s p e c i f y   a   v o l u m e S n a p s h o t C o n t e n t N a m e   a s   t h e   s o u r c e   f o r   t h e   s n a p s h o t   a s   s h o w n   i n   t h e   f o l l o w i n g   e x a m p l e .   T h e   v o l u m e S n a p s h o t C o n t e n t N a m e   s o u r c e   f i e l d   i s   r e q u i r e d   f o r   p r e - p r o v i s i o n e d   s n a p s h o t s .   a p i V e r s i o n :   s n a p s h o t . s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e S n a p s h o t   m e t a d a t a :   n a m e :   t e s t - s n a p s h o t   s p e c :   s o u r c e :   v o l u m e S n a p s h o t C o n t e n t N a m e :   t e s t - c o n t e n t


Question: What is Volume Snapshot Contents?

Answer: E a c h   V o l u m e S n a p s h o t C o n t e n t   c o n t a i n s   a   s p e c   a n d   s t a t u s .   I n   d y n a m i c   p r o v i s i o n i n g ,   t h e   s n a p s h o t   c o m m o n   c o n t r o l l e r   c r e a t e s   V o l u m e S n a p s h o t C o n t e n t   o b j e c t s .   H e r e   i s   a n   e x a m p l e :   a p i V e r s i o n :   s n a p s h o t . s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e S n a p s h o t C o n t e n t   m e t a d a t a :   n a m e :   s n a p c o n t e n t - 7 2 d 9 a 3 4 9 - a a c d - 4 2 d 2 - a 2 4 0 - d 7 7 5 6 5 0 d 2 4 5 5   s p e c :   d e l e t i o n P o l i c y :   D e l e t e   d r i v e r :   h o s t p a t h . c s i . k 8 s . i o   s o u r c e :   v o l u m e H a n d l e :   e e 0 c f b 9 4 - f 8 d 4 - 1 1 e 9 - b 2 d 8 - 0 2 4 2 a c 1 1 0 0 0 2   s o u r c e V o l u m e M o d e :   F i l e s y s t e m   v o l u m e S n a p s h o t C l a s s N a m e :   c s i - h o s t p a t h - s n a p c l a s s   v o l u m e S n a p s h o t R e f :   n a m e :   n e w - s n a p s h o t - t e s t   n a m e s p a c e :   d e f a u l t   u i d :   7 2 d 9 a 3 4 9 - a a c d - 4 2 d 2 - a 2 4 0 - d 7 7 5 6 5 0 d 2 4 5 5   v o l u m e H a n d l e   i s   t h e   u n i q u e   i d e n t i f i e r   o f   t h e   v o l u m e   c r e a t e d   o n   t h e   s t o r a g e   b a c k e n d   a n d   r e t u r n e d   b y   t h e   C S I   d r i v e r   d u r i n g   t h e   v o l u m e   c r e a t i o n .   T h i s   f i e l d   i s   r e q u i r e d   f o r   d y n a m i c a l l y   p r o v i s i o n i n g   a   s n a p s h o t .   I t   s p e c i f i e s   t h e   v o l u m e   s o u r c e   o f   t h e   s n a p s h o t .   F o r   p r e - p r o v i s i o n e d   s n a p s h o t s ,   y o u   ( a s   c l u s t e r   a d m i n i s t r a t o r )   a r e   r e s p o n s i b l e   f o r   c r e a t i n g   t h e   V o l u m e S n a p s h o t C o n t e n t   o b j e c t   a s   f o l l o w s .   a p i V e r s i o n :


Question: What is Converting the volume mode of a Snapshot?

Answer: I f   t h e   V o l u m e S n a p s h o t s   A P I   i n s t a l l e d   o n   y o u r   c l u s t e r   s u p p o r t s   t h e   s o u r c e V o l u m e M o d e   f i e l d ,   t h e n   t h e   A P I   h a s   t h e   c a p a b i l i t y   t o   p r e v e n t   u n a u t h o r i z e d   u s e r s   f r o m   c o n v e r t i n g   t h e   m o d e   o f   a   v o l u m e .   T o   c h e c k   i f   y o u r   c l u s t e r   h a s   c a p a b i l i t y   f o r   t h i s   f e a t u r e ,   r u n   t h e   f o l l o w i n g   c o m m a n d :   $   k u b e c t l   g e t   c r d   v o l u m e s n a p s h o t c o n t e n t   - o   y a m l   I f   y o u   w a n t   t o   a l l o w   u s e r s   t o   c r e a t e   a   P e r s i s t e n t V o l u m e C l a i m   f r o m   a n   e x i s t i n g   V o l u m e S n a p s h o t ,   b u t   w i t h   a   d i f f e r e n t   v o l u m e   m o d e   t h a n   t h e   s o u r c e ,   t h e   a n n o t a t i o n   s n a p s h o t . s t o r a g e . k u b e r n e t e s . i o / a l l o w - v o l u m e - m o d e - c h a n g e :   " t r u e " n e e d s   t o   b e   a d d e d   t o   t h e   V o l u m e S n a p s h o t C o n t e n t   t h a t   c o r r e s p o n d s   t o   t h e   V o l u m e S n a p s h o t .   F o r   p r e - p r o v i s i o n e d   s n a p s h o t s ,   s p e c . s o u r c e V o l u m e M o d e   n e e d s   t o   b e   p o p u l a t e d   b y   t h e   c l u s t e r   a d m i n i s t r a t o r .   A n   e x a m p l e   V o l u m e S n a p s h o t C o n t e n t   r e s o u r c e   w i t h   t h i s   f e a t u r e   e n a b l e d   w o u l d   l o o k   l i k e :   a p i V e r s i o n :   s n a p s h o t . s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e S n a p s h o t C o n t e n t   m e t a d a t a :   n a m e :   n e w - s n a p s h o t - c o n t e n t - t e s t   a n n o t a t i o n s :   -   s n a p s h o t . s t o r a g e . k u b e r n e t e s . i o / a l l o w - v o l u m e - m o d e - c h a n g


Question: What is Provisioning Volumes from Snapshots?

Answer: Y o u   c a n   p r o v i s i o n   a   n e w   v o l u m e ,   p r e - p o p u l a t e d   w i t h   d a t a   f r o m   a   s n a p s h o t ,   b y   u s i n g   t h e   d a t a S o u r c e   f i e l d   i n   t h e   P e r s i s t e n t V o l u m e C l a i m   o b j e c t .   F o r   m o r e   d e t a i l s ,   s e e   V o l u m e   S n a p s h o t   a n d   R e s t o r e   V o l u m e   f r o m   S n a p s h o t .


Question: What is Policies?

Answer: PoliciesManage security and best-practices with policies.Kubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in the Kubernetes ecosystem, such as:KubewardenKyvernoOPA GatekeeperPolarisApply policies using Kubelet configurationsKubernetes allows configuring the Kubelet on each worker node. Some Kubelet configurations act


Question: How does Policies work?

Answer: PoliciesManage security and best-practices with policies.Kubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in the Kubernetes ecosystem, such as:KubewardenKyvernoOPA GatekeeperPolarisApply policies using Kubelet configurationsKubernetes allows configuring the Kubelet on each worker node. Some Kubelet configurations act


Question: When would you use Policies?

Answer: PoliciesManage security and best-practices with policies.Kubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in the Kubernetes ecosystem, such as:KubewardenKyvernoOPA GatekeeperPolarisApply policies using Kubelet configurationsKubernetes allows configuring the Kubelet on each worker node. Some Kubelet configurations act


Question: What are the benefits of Policies?

Answer: PoliciesManage security and best-practices with policies.Kubernetes policies are configurations that manage other configurations or runtime behaviors. Kubernetes offers various forms of policies, described below:Apply policies using API objectsSome API objects act as policies. Here are some examples:NetworkPolicies can be used to restrict ingress and egress traffic for a workload.LimitRanges manage resource allocation constraints across different object kinds.ResourceQuotas limit resource consumption for a namespace.Apply policies using admission controllersAn admission controller runs in the API server and can validate or mutate API requests. Some admission controllers act to apply policies. For example, the AlwaysPullImages admission controller modifies a new Pod to set the image pull policy to Always.Kubernetes has several built-in admission controllers that are configurable via the API server --enable-admission-plugins flag.Details on admission controllers, with the complete list of available admission controllers, are documented in a dedicated section:Admission ControllersApply policies using ValidatingAdmissionPolicyValidating admission policies allow configurable validation checks to be executed in the API server using the Common Expression Language (CEL). For example, a ValidatingAdmissionPolicy can be used to disallow use of the latest image tag.A ValidatingAdmissionPolicy operates on an API request and can be used to block, audit, and warn users about non-compliant configurations.Details on the ValidatingAdmissionPolicy API, with examples, are documented in a dedicated section:Validating Admission PolicyApply policies using dynamic admission controlDynamic admission controllers (or admission webhooks) run outside the API server as separate applications that register to receive webhooks requests to perform validation or mutation of API requests.Dynamic admission controllers can be used to apply policies on API requests and trigger other policy-based workflows. A dynamic admission controller can perform complex checks including those that require retrieval of other cluster resources and external data. For example, an image verification check can lookup data from OCI registries to validate the container image signatures and attestations.Details on dynamic admission control are documented in a dedicated section:Dynamic Admission ControlImplementationsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Dynamic Admission Controllers that act as flexible policy engines are being developed in the Kubernetes ecosystem, such as:KubewardenKyvernoOPA GatekeeperPolarisApply policies using Kubelet configurationsKubernetes allows configuring the Kubelet on each worker node. Some Kubelet configurations act


Question: What is Policies?

Answer: K u b e r n e t e s   p o l i c i e s   a r e   c o n f i g u r a t i o n s   t h a t   m a n a g e   o t h e r   c o n f i g u r a t i o n s   o r   r u n t i m e   b e h a v i o r s .   K u b e r n e t e s   o f f e r s   v a r i o u s   f o r m s   o f   p o l i c i e s ,   d e s c r i b e d   b e l o w :


Question: What is Apply policies using API objects?

Answer: S o m e   A P I   o b j e c t s   a c t   a s   p o l i c i e s .   H e r e   a r e   s o m e   e x a m p l e s :   N e t w o r k P o l i c i e s   c a n   b e   u s e d   t o   r e s t r i c t   i n g r e s s   a n d   e g r e s s   t r a f f i c   f o r   a   w o r k l o a d . L i m i t R a n g e s   m a n a g e   r e s o u r c e   a l l o c a t i o n   c o n s t r a i n t s   a c r o s s   d i f f e r e n t   o b j e c t   k i n d s . R e s o u r c e Q u o t a s   l i m i t   r e s o u r c e   c o n s u m p t i o n   f o r   a   n a m e s p a c e .


Question: What is Apply policies using admission controllers?

Answer: A n   a d m i s s i o n   c o n t r o l l e r   r u n s   i n   t h e   A P I   s e r v e r   a n d   c a n   v a l i d a t e   o r   m u t a t e   A P I   r e q u e s t s .   S o m e   a d m i s s i o n   c o n t r o l l e r s   a c t   t o   a p p l y   p o l i c i e s .   F o r   e x a m p l e ,   t h e   A l w a y s P u l l I m a g e s   a d m i s s i o n   c o n t r o l l e r   m o d i f i e s   a   n e w   P o d   t o   s e t   t h e   i m a g e   p u l l   p o l i c y   t o   A l w a y s .   K u b e r n e t e s   h a s   s e v e r a l   b u i l t - i n   a d m i s s i o n   c o n t r o l l e r s   t h a t   a r e   c o n f i g u r a b l e   v i a   t h e   A P I   s e r v e r   - - e n a b l e - a d m i s s i o n - p l u g i n s   f l a g .   D e t a i l s   o n   a d m i s s i o n   c o n t r o l l e r s ,   w i t h   t h e   c o m p l e t e   l i s t   o f   a v a i l a b l e   a d m i s s i o n   c o n t r o l l e r s ,   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   A d m i s s i o n   C o n t r o l l e r s


Question: What is Apply policies using ValidatingAdmissionPolicy?

Answer: V a l i d a t i n g   a d m i s s i o n   p o l i c i e s   a l l o w   c o n f i g u r a b l e   v a l i d a t i o n   c h e c k s   t o   b e   e x e c u t e d   i n   t h e   A P I   s e r v e r   u s i n g   t h e   C o m m o n   E x p r e s s i o n   L a n g u a g e   ( C E L ) .   F o r   e x a m p l e ,   a   V a l i d a t i n g A d m i s s i o n P o l i c y   c a n   b e   u s e d   t o   d i s a l l o w   u s e   o f   t h e   l a t e s t   i m a g e   t a g .   A   V a l i d a t i n g A d m i s s i o n P o l i c y   o p e r a t e s   o n   a n   A P I   r e q u e s t   a n d   c a n   b e   u s e d   t o   b l o c k ,   a u d i t ,   a n d   w a r n   u s e r s   a b o u t   n o n - c o m p l i a n t   c o n f i g u r a t i o n s .   D e t a i l s   o n   t h e   V a l i d a t i n g A d m i s s i o n P o l i c y   A P I ,   w i t h   e x a m p l e s ,   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   V a l i d a t i n g   A d m i s s i o n   P o l i c y


Question: What is Apply policies using dynamic admission control?

Answer: D y n a m i c   a d m i s s i o n   c o n t r o l l e r s   ( o r   a d m i s s i o n   w e b h o o k s )   r u n   o u t s i d e   t h e   A P I   s e r v e r   a s   s e p a r a t e   a p p l i c a t i o n s   t h a t   r e g i s t e r   t o   r e c e i v e   w e b h o o k s   r e q u e s t s   t o   p e r f o r m   v a l i d a t i o n   o r   m u t a t i o n   o f   A P I   r e q u e s t s .   D y n a m i c   a d m i s s i o n   c o n t r o l l e r s   c a n   b e   u s e d   t o   a p p l y   p o l i c i e s   o n   A P I   r e q u e s t s   a n d   t r i g g e r   o t h e r   p o l i c y - b a s e d   w o r k f l o w s .   A   d y n a m i c   a d m i s s i o n   c o n t r o l l e r   c a n   p e r f o r m   c o m p l e x   c h e c k s   i n c l u d i n g   t h o s e   t h a t   r e q u i r e   r e t r i e v a l   o f   o t h e r   c l u s t e r   r e s o u r c e s   a n d   e x t e r n a l   d a t a .   F o r   e x a m p l e ,   a n   i m a g e   v e r i f i c a t i o n   c h e c k   c a n   l o o k u p   d a t a   f r o m   O C I   r e g i s t r i e s   t o   v a l i d a t e   t h e   c o n t a i n e r   i m a g e   s i g n a t u r e s   a n d   a t t e s t a t i o n s .   D e t a i l s   o n   d y n a m i c   a d m i s s i o n   c o n t r o l   a r e   d o c u m e n t e d   i n   a   d e d i c a t e d   s e c t i o n :   D y n a m i c   A d m i s s i o n   C o n t r o l


Question: What is Implementations?

Answer: D y n a m i c   A d m i s s i o n   C o n t r o l l e r s   t h a t   a c t   a s   f l e x i b l e   p o l i c y   e n g i n e s   a r e   b e i n g   d e v e l o p e d   i n   t h e   K u b e r n e t e s   e c o s y s t e m ,   s u c h   a s :   K u b e w a r d e n K y v e r n o O P A   G a t e k e e p e r P o l a r i s


Question: What is Apply policies using Kubelet configurations?

Answer: K u b e r n e t e s   a l l o w s   c o n f i g u r i n g   t h e   K u b e l e t   o n   e a c h   w o r k e r   n o d e .   S o m e   K u b e l e t   c o n f i g u r a t i o n s   a c t   a s   p o l i c i e s :   P r o c e s s   I D   l i m i t s   a n d   r e s e r v a t i o n s   a r e   u s e d   t o   l i m i t   a n d   r e s e r v e   a l l o c a t a b l e   P I D s . N o d e   R e s o u r c e   M a n a g e r s   c a n   m a n a g e   c o m p u t e ,   m e m o r y ,   a n d   d e v i c e   r e s o u r c e s   f o r   l a t e n c y - c r i t i c a l   a n d   h i g h - t h r o u g h p u t   w o r k l o a d s .   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Creating a cluster with kubeadm?

Answer: Creating a cluster with kubeadm Using kubeadm, you can create a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use kubeadm to set up a cluster that will pass the Kubernetes Conformance tests. kubeadm also supports other cluster lifecycle functions, such as bootstrap tokens and cluster upgrades.The kubeadm tool is good if you need:A simple way for you to try out Kubernetes, possibly for the first time.A way for existing users to automate setting up a cluster and test their application.A building block in other ecosystem and/or installer tools with a larger scope.You can install and use kubeadm on various machines: your laptop, a set of cloud servers, a Raspberry Pi, and more. Whether you're deploying into the cloud or on-premises, you can integrate kubeadm into provisioning systems such as Ansible or Terraform.Before you beginTo follow this guide, you need:One or more machines running a deb/rpm-compatible Linux OS; for example: Ubuntu or CentOS.2 GiB or more of RAM per machine--any less leaves little room for your apps.At least 2 CPUs on the machine that you use as a control-plane node.Full network connectivity among all machines in the cluster. You can use either a public or a private network.You also need to use a version of kubeadm that can deploy the version of Kubernetes that you want to use in your new cluster.Kubernetes' version and version skew support policy applies to kubeadm as well as to Kubernetes overall. Check that policy to learn about what versions of Kubernetes and kubeadm are supported. This page is written for Kubernetes v1.34.The kubeadm tool's overall feature state is General Availability (GA). Some sub-features are still under active development. The implementation of creating the cluster may change slightly as the tool evolves, but the overall implementation should be pretty stable.Note:Any commands under kubeadm alpha are, by definition, supported on an alpha level.ObjectivesInstall a single control-plane Kubernetes clusterInstall a Pod network on the cluster so that your Pods can talk to each otherInstructionsPreparing the hostsComponent installationInstall a container runtime and kubeadm on all the hosts. For detailed instructions and other prerequisites, see Installing kubeadm.Note:If you have already installed kubeadm, see the first two steps of the Upgrading Linux nodes document for instructions on how to upgrade kubeadm.When you upgrade, the kubelet restarts every few seconds as it waits in a crashloop for kubeadm to tell it what to do. This crashloop is expected and normal. After you initialize your control-plane, the kubelet runs normally.Network setupkubeadm similarly to other Kubernetes components tries to find a usable IP on the network interfaces associated with a default gateway on a host. Such an IP is then used for the advertising and/or listening performed by a component.To find out what this IP is on a Linux host you can use:ip route show # Look for a line starting with


Question: How does Creating a cluster with kubeadm work?

Answer: Creating a cluster with kubeadm Using kubeadm, you can create a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use kubeadm to set up a cluster that will pass the Kubernetes Conformance tests. kubeadm also supports other cluster lifecycle functions, such as bootstrap tokens and cluster upgrades.The kubeadm tool is good if you need:A simple way for you to try out Kubernetes, possibly for the first time.A way for existing users to automate setting up a cluster and test their application.A building block in other ecosystem and/or installer tools with a larger scope.You can install and use kubeadm on various machines: your laptop, a set of cloud servers, a Raspberry Pi, and more. Whether you're deploying into the cloud or on-premises, you can integrate kubeadm into provisioning systems such as Ansible or Terraform.Before you beginTo follow this guide, you need:One or more machines running a deb/rpm-compatible Linux OS; for example: Ubuntu or CentOS.2 GiB or more of RAM per machine--any less leaves little room for your apps.At least 2 CPUs on the machine that you use as a control-plane node.Full network connectivity among all machines in the cluster. You can use either a public or a private network.You also need to use a version of kubeadm that can deploy the version of Kubernetes that you want to use in your new cluster.Kubernetes' version and version skew support policy applies to kubeadm as well as to Kubernetes overall. Check that policy to learn about what versions of Kubernetes and kubeadm are supported. This page is written for Kubernetes v1.34.The kubeadm tool's overall feature state is General Availability (GA). Some sub-features are still under active development. The implementation of creating the cluster may change slightly as the tool evolves, but the overall implementation should be pretty stable.Note:Any commands under kubeadm alpha are, by definition, supported on an alpha level.ObjectivesInstall a single control-plane Kubernetes clusterInstall a Pod network on the cluster so that your Pods can talk to each otherInstructionsPreparing the hostsComponent installationInstall a container runtime and kubeadm on all the hosts. For detailed instructions and other prerequisites, see Installing kubeadm.Note:If you have already installed kubeadm, see the first two steps of the Upgrading Linux nodes document for instructions on how to upgrade kubeadm.When you upgrade, the kubelet restarts every few seconds as it waits in a crashloop for kubeadm to tell it what to do. This crashloop is expected and normal. After you initialize your control-plane, the kubelet runs normally.Network setupkubeadm similarly to other Kubernetes components tries to find a usable IP on the network interfaces associated with a default gateway on a host. Such an IP is then used for the advertising and/or listening performed by a component.To find out what this IP is on a Linux host you can use:ip route show # Look for a line starting with


Question: When would you use Creating a cluster with kubeadm?

Answer: Creating a cluster with kubeadm Using kubeadm, you can create a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use kubeadm to set up a cluster that will pass the Kubernetes Conformance tests. kubeadm also supports other cluster lifecycle functions, such as bootstrap tokens and cluster upgrades.The kubeadm tool is good if you need:A simple way for you to try out Kubernetes, possibly for the first time.A way for existing users to automate setting up a cluster and test their application.A building block in other ecosystem and/or installer tools with a larger scope.You can install and use kubeadm on various machines: your laptop, a set of cloud servers, a Raspberry Pi, and more. Whether you're deploying into the cloud or on-premises, you can integrate kubeadm into provisioning systems such as Ansible or Terraform.Before you beginTo follow this guide, you need:One or more machines running a deb/rpm-compatible Linux OS; for example: Ubuntu or CentOS.2 GiB or more of RAM per machine--any less leaves little room for your apps.At least 2 CPUs on the machine that you use as a control-plane node.Full network connectivity among all machines in the cluster. You can use either a public or a private network.You also need to use a version of kubeadm that can deploy the version of Kubernetes that you want to use in your new cluster.Kubernetes' version and version skew support policy applies to kubeadm as well as to Kubernetes overall. Check that policy to learn about what versions of Kubernetes and kubeadm are supported. This page is written for Kubernetes v1.34.The kubeadm tool's overall feature state is General Availability (GA). Some sub-features are still under active development. The implementation of creating the cluster may change slightly as the tool evolves, but the overall implementation should be pretty stable.Note:Any commands under kubeadm alpha are, by definition, supported on an alpha level.ObjectivesInstall a single control-plane Kubernetes clusterInstall a Pod network on the cluster so that your Pods can talk to each otherInstructionsPreparing the hostsComponent installationInstall a container runtime and kubeadm on all the hosts. For detailed instructions and other prerequisites, see Installing kubeadm.Note:If you have already installed kubeadm, see the first two steps of the Upgrading Linux nodes document for instructions on how to upgrade kubeadm.When you upgrade, the kubelet restarts every few seconds as it waits in a crashloop for kubeadm to tell it what to do. This crashloop is expected and normal. After you initialize your control-plane, the kubelet runs normally.Network setupkubeadm similarly to other Kubernetes components tries to find a usable IP on the network interfaces associated with a default gateway on a host. Such an IP is then used for the advertising and/or listening performed by a component.To find out what this IP is on a Linux host you can use:ip route show # Look for a line starting with


Question: What are the benefits of Creating a cluster with kubeadm?

Answer: Creating a cluster with kubeadm Using kubeadm, you can create a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use kubeadm to set up a cluster that will pass the Kubernetes Conformance tests. kubeadm also supports other cluster lifecycle functions, such as bootstrap tokens and cluster upgrades.The kubeadm tool is good if you need:A simple way for you to try out Kubernetes, possibly for the first time.A way for existing users to automate setting up a cluster and test their application.A building block in other ecosystem and/or installer tools with a larger scope.You can install and use kubeadm on various machines: your laptop, a set of cloud servers, a Raspberry Pi, and more. Whether you're deploying into the cloud or on-premises, you can integrate kubeadm into provisioning systems such as Ansible or Terraform.Before you beginTo follow this guide, you need:One or more machines running a deb/rpm-compatible Linux OS; for example: Ubuntu or CentOS.2 GiB or more of RAM per machine--any less leaves little room for your apps.At least 2 CPUs on the machine that you use as a control-plane node.Full network connectivity among all machines in the cluster. You can use either a public or a private network.You also need to use a version of kubeadm that can deploy the version of Kubernetes that you want to use in your new cluster.Kubernetes' version and version skew support policy applies to kubeadm as well as to Kubernetes overall. Check that policy to learn about what versions of Kubernetes and kubeadm are supported. This page is written for Kubernetes v1.34.The kubeadm tool's overall feature state is General Availability (GA). Some sub-features are still under active development. The implementation of creating the cluster may change slightly as the tool evolves, but the overall implementation should be pretty stable.Note:Any commands under kubeadm alpha are, by definition, supported on an alpha level.ObjectivesInstall a single control-plane Kubernetes clusterInstall a Pod network on the cluster so that your Pods can talk to each otherInstructionsPreparing the hostsComponent installationInstall a container runtime and kubeadm on all the hosts. For detailed instructions and other prerequisites, see Installing kubeadm.Note:If you have already installed kubeadm, see the first two steps of the Upgrading Linux nodes document for instructions on how to upgrade kubeadm.When you upgrade, the kubelet restarts every few seconds as it waits in a crashloop for kubeadm to tell it what to do. This crashloop is expected and normal. After you initialize your control-plane, the kubelet runs normally.Network setupkubeadm similarly to other Kubernetes components tries to find a usable IP on the network interfaces associated with a default gateway on a host. Such an IP is then used for the advertising and/or listening performed by a component.To find out what this IP is on a Linux host you can use:ip route show # Look for a line starting with


Question: What is Creating a cluster with kubeadm?

Answer: U s i n g   k u b e a d m ,   y o u   c a n   c r e a t e   a   m i n i m u m   v i a b l e   K u b e r n e t e s   c l u s t e r   t h a t   c o n f o r m s   t o   b e s t   p r a c t i c e s .   I n   f a c t ,   y o u   c a n   u s e   k u b e a d m   t o   s e t   u p   a   c l u s t e r   t h a t   w i l l   p a s s   t h e   K u b e r n e t e s   C o n f o r m a n c e   t e s t s .   k u b e a d m   a l s o   s u p p o r t s   o t h e r   c l u s t e r   l i f e c y c l e   f u n c t i o n s ,   s u c h   a s   b o o t s t r a p   t o k e n s   a n d   c l u s t e r   u p g r a d e s .   T h e   k u b e a d m   t o o l   i s   g o o d   i f   y o u   n e e d :   A   s i m p l e   w a y   f o r   y o u   t o   t r y   o u t   K u b e r n e t e s ,   p o s s i b l y   f o r   t h e   f i r s t   t i m e . A   w a y   f o r   e x i s t i n g   u s e r s   t o   a u t o m a t e   s e t t i n g   u p   a   c l u s t e r   a n d   t e s t   t h e i r   a p p l i c a t i o n . A   b u i l d i n g   b l o c k   i n   o t h e r   e c o s y s t e m   a n d / o r   i n s t a l l e r   t o o l s   w i t h   a   l a r g e r   s c o p e .   Y o u   c a n   i n s t a l l   a n d   u s e   k u b e a d m   o n   v a r i o u s   m a c h i n e s :   y o u r   l a p t o p ,   a   s e t   o f   c l o u d   s e r v e r s ,   a   R a s p b e r r y   P i ,   a n d   m o r e .   W h e t h e r   y o u ' r e   d e p l o y i n g   i n t o   t h e   c l o u d   o r   o n - p r e m i s e s ,   y o u   c a n   i n t e g r a t e   k u b e a d m   i n t o   p r o v i s i o n i n g   s y s t e m s   s u c h   a s   A n s i b l e   o r   T e r r a f o r m .


Question: What is Before you begin?

Answer: T o   f o l l o w   t h i s   g u i d e ,   y o u   n e e d :   O n e   o r   m o r e   m a c h i n e s   r u n n i n g   a   d e b / r p m - c o m p a t i b l e   L i n u x   O S ;   f o r   e x a m p l e :   U b u n t u   o r   C e n t O S . 2   G i B   o r   m o r e   o f   R A M   p e r   m a c h i n e - - a n y   l e s s   l e a v e s   l i t t l e   r o o m   f o r   y o u r   a p p s . A t   l e a s t   2   C P U s   o n   t h e   m a c h i n e   t h a t   y o u   u s e   a s   a   c o n t r o l - p l a n e   n o d e . F u l l   n e t w o r k   c o n n e c t i v i t y   a m o n g   a l l   m a c h i n e s   i n   t h e   c l u s t e r .   Y o u   c a n   u s e   e i t h e r   a   p u b l i c   o r   a   p r i v a t e   n e t w o r k .   Y o u   a l s o   n e e d   t o   u s e   a   v e r s i o n   o f   k u b e a d m   t h a t   c a n   d e p l o y   t h e   v e r s i o n   o f   K u b e r n e t e s   t h a t   y o u   w a n t   t o   u s e   i n   y o u r   n e w   c l u s t e r .   K u b e r n e t e s '   v e r s i o n   a n d   v e r s i o n   s k e w   s u p p o r t   p o l i c y   a p p l i e s   t o   k u b e a d m   a s   w e l l   a s   t o   K u b e r n e t e s   o v e r a l l .   C h e c k   t h a t   p o l i c y   t o   l e a r n   a b o u t   w h a t   v e r s i o n s   o f   K u b e r n e t e s   a n d   k u b e a d m   a r e   s u p p o r t e d .   T h i s   p a g e   i s   w r i t t e n   f o r   K u b e r n e t e s   v 1 . 3 4 .   T h e   k u b e a d m   t o o l ' s   o v e r a l l   f e a t u r e   s t a t e   i s   G e n e r a l   A v a i l a b i l i t y   ( G A ) .   S o m e   s u b - f e a t u r e s   a r e   s t i l l   u n d e r   a c t i v e   d e v e l o p m e n t .   T h e   i m p l e m e n t a t i o n   o f   c r e a t i n g   t h e   c l u s t e r   m a y   c h a n g e   s l i g h t l y   a s   t h e   t o o l   e v o l v e s ,   b u t   t h e   o v e r a l l   i m p l e m e n t a t i o n   s h o u l d   b e   p r e t t y   s t a b


Question: What is Objectives?

Answer: I n s t a l l   a   s i n g l e   c o n t r o l - p l a n e   K u b e r n e t e s   c l u s t e r I n s t a l l   a   P o d   n e t w o r k   o n   t h e   c l u s t e r   s o   t h a t   y o u r   P o d s   c a n   t a l k   t o   e a c h   o t h e r


Question: What is Component installation?

Answer: I n s t a l l   a   c o n t a i n e r   r u n t i m e   a n d   k u b e a d m   o n   a l l   t h e   h o s t s .   F o r   d e t a i l e d   i n s t r u c t i o n s   a n d   o t h e r   p r e r e q u i s i t e s ,   s e e   I n s t a l l i n g   k u b e a d m .


Question: What is Note:?

Answer: I f   y o u   h a v e   a l r e a d y   i n s t a l l e d   k u b e a d m ,   s e e   t h e   f i r s t   t w o   s t e p s   o f   t h e   U p g r a d i n g   L i n u x   n o d e s   d o c u m e n t   f o r   i n s t r u c t i o n s   o n   h o w   t o   u p g r a d e   k u b e a d m .   W h e n   y o u   u p g r a d e ,   t h e   k u b e l e t   r e s t a r t s   e v e r y   f e w   s e c o n d s   a s   i t   w a i t s   i n   a   c r a s h l o o p   f o r   k u b e a d m   t o   t e l l   i t   w h a t   t o   d o .   T h i s   c r a s h l o o p   i s   e x p e c t e d   a n d   n o r m a l .   A f t e r   y o u   i n i t i a l i z e   y o u r   c o n t r o l - p l a n e ,   t h e   k u b e l e t   r u n s   n o r m a l l y .


Question: What is Network setup?

Answer: k u b e a d m   s i m i l a r l y   t o   o t h e r   K u b e r n e t e s   c o m p o n e n t s   t r i e s   t o   f i n d   a   u s a b l e   I P   o n   t h e   n e t w o r k   i n t e r f a c e s   a s s o c i a t e d   w i t h   a   d e f a u l t   g a t e w a y   o n   a   h o s t .   S u c h   a n   I P   i s   t h e n   u s e d   f o r   t h e   a d v e r t i s i n g   a n d / o r   l i s t e n i n g   p e r f o r m e d   b y   a   c o m p o n e n t .   T o   f i n d   o u t   w h a t   t h i s   I P   i s   o n   a   L i n u x   h o s t   y o u   c a n   u s e :   i p   r o u t e   s h o w   #   L o o k   f o r   a   l i n e   s t a r t i n g   w i t h   " d e f a u l t   v i a "


Question: What is Note:?

Answer: K u b e r n e t e s   c o m p o n e n t s   d o   n o t   a c c e p t   c u s t o m   n e t w o r k   i n t e r f a c e   a s   a n   o p t i o n ,   t h e r e f o r e   a   c u s t o m   I P   a d d r e s s   m u s t   b e   p a s s e d   a s   a   f l a g   t o   a l l   c o m p o n e n t s   i n s t a n c e s   t h a t   n e e d   s u c h   a   c u s t o m   c o n f i g u r a t i o n .


Question: What is Note:?

Answer: T o   c o n f i g u r e   t h e   A P I   s e r v e r   a d v e r t i s e   a d d r e s s   f o r   c o n t r o l   p l a n e   n o d e s   c r e a t e d   w i t h   b o t h   i n i t   a n d   j o i n ,   t h e   f l a g   - - a p i s e r v e r - a d v e r t i s e - a d d r e s s   c a n   b e   u s e d .   P r e f e r a b l y ,   t h i s   o p t i o n   c a n   b e   s e t   i n   t h e   k u b e a d m   A P I   a s   I n i t C o n f i g u r a t i o n . l o c a l A P I E n d p o i n t   a n d   J o i n C o n f i g u r a t i o n . c o n t r o l P l a n e . l o c a l A P I E n d p o i n t .   F o r   k u b e l e t s   o n   a l l   n o d e s ,   t h e   - - n o d e - i p   o p t i o n   c a n   b e   p a s s e d   i n   . n o d e R e g i s t r a t i o n . k u b e l e t E x t r a A r g s   i n s i d e   a   k u b e a d m   c o n f i g u r a t i o n   f i l e   ( I n i t C o n f i g u r a t i o n   o r   J o i n C o n f i g u r a t i o n ) .   F o r   d u a l - s t a c k   s e e   D u a l - s t a c k   s u p p o r t   w i t h   k u b e a d m .   T h e   I P   a d d r e s s e s   t h a t   y o u   a s s i g n   t o   c o n t r o l   p l a n e   c o m p o n e n t s   b e c o m e   p a r t   o f   t h e i r   X . 5 0 9   c e r t i f i c a t e s '   s u b j e c t   a l t e r n a t i v e   n a m e   f i e l d s .   C h a n g i n g   t h e s e   I P   a d d r e s s e s   w o u l d   r e q u i r e   s i g n i n g   n e w   c e r t i f i c a t e s   a n d   r e s t a r t i n g   t h e   a f f e c t e d   c o m p o n e n t s ,   s o   t h a t   t h e   c h a n g e   i n   c e r t i f i c a t e   f i l e s   i s   r e f l e c t e d .   S e e   M a n u a l   c e r t i f i c a t e   r e n e w a l   f o r   m o r e   d e t a i l s   o n   t h i s   t o p i c .


Question: What is Preparing the required container images?

Answer: T h i s   s t e p   i s   o p t i o n a l   a n d   o n l y   a p p l i e s   i n   c a s e   y o u   w i s h   k u b e a d m   i n i t   a n d   k u b e a d m   j o i n   t o   n o t   d o w n l o a d   t h e   d e f a u l t   c o n t a i n e r   i m a g e s   w h i c h   a r e   h o s t e d   a t   r e g i s t r y . k 8 s . i o .   K u b e a d m   h a s   c o m m a n d s   t h a t   c a n   h e l p   y o u   p r e - p u l l   t h e   r e q u i r e d   i m a g e s   w h e n   c r e a t i n g   a   c l u s t e r   w i t h o u t   a n   i n t e r n e t   c o n n e c t i o n   o n   i t s   n o d e s .   S e e   R u n n i n g   k u b e a d m   w i t h o u t   a n   i n t e r n e t   c o n n e c t i o n   f o r   m o r e   d e t a i l s .   K u b e a d m   a l l o w s   y o u   t o   u s e   a   c u s t o m   i m a g e   r e p o s i t o r y   f o r   t h e   r e q u i r e d   i m a g e s .   S e e   U s i n g   c u s t o m   i m a g e s   f o r   m o r e   d e t a i l s .


Question: What is Initializing your control-plane node?

Answer: T h e   c o n t r o l - p l a n e   n o d e   i s   t h e   m a c h i n e   w h e r e   t h e   c o n t r o l   p l a n e   c o m p o n e n t s   r u n ,   i n c l u d i n g   e t c d   ( t h e   c l u s t e r   d a t a b a s e )   a n d   t h e   A P I   S e r v e r   ( w h i c h   t h e   k u b e c t l   c o m m a n d   l i n e   t o o l   c o m m u n i c a t e s   w i t h ) .   ( R e c o m m e n d e d )   I f   y o u   h a v e   p l a n s   t o   u p g r a d e   t h i s   s i n g l e   c o n t r o l - p l a n e   k u b e a d m   c l u s t e r   t o   h i g h   a v a i l a b i l i t y   y o u   s h o u l d   s p e c i f y   t h e   - - c o n t r o l - p l a n e - e n d p o i n t   t o   s e t   t h e   s h a r e d   e n d p o i n t   f o r   a l l   c o n t r o l - p l a n e   n o d e s .   S u c h   a n   e n d p o i n t   c a n   b e   e i t h e r   a   D N S   n a m e   o r   a n   I P   a d d r e s s   o f   a   l o a d - b a l a n c e r . C h o o s e   a   P o d   n e t w o r k   a d d - o n ,   a n d   v e r i f y   w h e t h e r   i t   r e q u i r e s   a n y   a r g u m e n t s   t o   b e   p a s s e d   t o   k u b e a d m   i n i t .   D e p e n d i n g   o n   w h i c h   t h i r d - p a r t y   p r o v i d e r   y o u   c h o o s e ,   y o u   m i g h t   n e e d   t o   s e t   t h e   - - p o d - n e t w o r k - c i d r   t o   a   p r o v i d e r - s p e c i f i c   v a l u e .   S e e   I n s t a l l i n g   a   P o d   n e t w o r k   a d d - o n . ( O p t i o n a l )   k u b e a d m   t r i e s   t o   d e t e c t   t h e   c o n t a i n e r   r u n t i m e   b y   u s i n g   a   l i s t   o f   w e l l   k n o w n   e n d p o i n t s .   T o   u s e   d i f f e r e n t   c o n t a i n e r   r u n t i m e   o r   i f   t h e r e   a r e   m o r e   t h a n   o n e   i n s t a l l e d   o n   t h e   p r o v i s i o n e d   n o d e ,   s p e c i f y   t h e   - - c r i - s o c k e t   a r g u m e n t   t o   k u b e a d m .   S e e   I n s t a


Question: What is Considerations about apiserver-advertise-address and ControlPlaneEndpoint?

Answer: W h i l e   - - a p i s e r v e r - a d v e r t i s e - a d d r e s s   c a n   b e   u s e d   t o   s e t   t h e   a d v e r t i s e d   a d d r e s s   f o r   t h i s   p a r t i c u l a r   c o n t r o l - p l a n e   n o d e ' s   A P I   s e r v e r ,   - - c o n t r o l - p l a n e - e n d p o i n t   c a n   b e   u s e d   t o   s e t   t h e   s h a r e d   e n d p o i n t   f o r   a l l   c o n t r o l - p l a n e   n o d e s .   - - c o n t r o l - p l a n e - e n d p o i n t   a l l o w s   b o t h   I P   a d d r e s s e s   a n d   D N S   n a m e s   t h a t   c a n   m a p   t o   I P   a d d r e s s e s .   P l e a s e   c o n t a c t   y o u r   n e t w o r k   a d m i n i s t r a t o r   t o   e v a l u a t e   p o s s i b l e   s o l u t i o n s   w i t h   r e s p e c t   t o   s u c h   m a p p i n g .   H e r e   i s   a n   e x a m p l e   m a p p i n g :   1 9 2 . 1 6 8 . 0 . 1 0 2   c l u s t e r - e n d p o i n t   W h e r e   1 9 2 . 1 6 8 . 0 . 1 0 2   i s   t h e   I P   a d d r e s s   o f   t h i s   n o d e   a n d   c l u s t e r - e n d p o i n t   i s   a   c u s t o m   D N S   n a m e   t h a t   m a p s   t o   t h i s   I P .   T h i s   w i l l   a l l o w   y o u   t o   p a s s   - - c o n t r o l - p l a n e - e n d p o i n t = c l u s t e r - e n d p o i n t   t o   k u b e a d m   i n i t   a n d   p a s s   t h e   s a m e   D N S   n a m e   t o   k u b e a d m   j o i n .   L a t e r   y o u   c a n   m o d i f y   c l u s t e r - e n d p o i n t   t o   p o i n t   t o   t h e   a d d r e s s   o f   y o u r   l o a d - b a l a n c e r   i n   a   h i g h   a v a i l a b i l i t y   s c e n a r i o .   T u r n i n g   a   s i n g l e   c o n t r o l   p l a n e   c l u s t e r   c r e a t e d   w i t h o u t   - - c o n t r o l - p l a n e - e n d p o i n t   i n t o   a   h i g h l y   a v a i l a b l e   c l u s t e r   i s   n o t   s u p p o r t e d   b y   k u b e a d m .


Question: What is More information?

Answer: F o r   m o r e   i n f o r m a t i o n   a b o u t   k u b e a d m   i n i t   a r g u m e n t s ,   s e e   t h e   k u b e a d m   r e f e r e n c e   g u i d e .   T o   c o n f i g u r e   k u b e a d m   i n i t   w i t h   a   c o n f i g u r a t i o n   f i l e   s e e   U s i n g   k u b e a d m   i n i t   w i t h   a   c o n f i g u r a t i o n   f i l e .   T o   c u s t o m i z e   c o n t r o l   p l a n e   c o m p o n e n t s ,   i n c l u d i n g   o p t i o n a l   I P v 6   a s s i g n m e n t   t o   l i v e n e s s   p r o b e   f o r   c o n t r o l   p l a n e   c o m p o n e n t s   a n d   e t c d   s e r v e r ,   p r o v i d e   e x t r a   a r g u m e n t s   t o   e a c h   c o m p o n e n t   a s   d o c u m e n t e d   i n   c u s t o m   a r g u m e n t s .   T o   r e c o n f i g u r e   a   c l u s t e r   t h a t   h a s   a l r e a d y   b e e n   c r e a t e d   s e e   R e c o n f i g u r i n g   a   k u b e a d m   c l u s t e r .   T o   r u n   k u b e a d m   i n i t   a g a i n ,   y o u   m u s t   f i r s t   t e a r   d o w n   t h e   c l u s t e r .   I f   y o u   j o i n   a   n o d e   w i t h   a   d i f f e r e n t   a r c h i t e c t u r e   t o   y o u r   c l u s t e r ,   m a k e   s u r e   t h a t   y o u r   d e p l o y e d   D a e m o n S e t s   h a v e   c o n t a i n e r   i m a g e   s u p p o r t   f o r   t h i s   a r c h i t e c t u r e .   k u b e a d m   i n i t   f i r s t   r u n s   a   s e r i e s   o f   p r e c h e c k s   t o   e n s u r e   t h a t   t h e   m a c h i n e   i s   r e a d y   t o   r u n   K u b e r n e t e s .   T h e s e   p r e c h e c k s   e x p o s e   w a r n i n g s   a n d   e x i t   o n   e r r o r s .   k u b e a d m   i n i t   t h e n   d o w n l o a d s   a n d   i n s t a l l s   t h e   c l u s t e r   c o n t r o l   p l a n e   c o m p o n e n t s .   T h i s   m a y   t a k e   s e v e r a l   m i n u t e s .   A f t e r   i t   f i n i s h e s   y o u


Question: What is Warning:?

Answer: T h e   k u b e c o n f i g   f i l e   a d m i n . c o n f   t h a t   k u b e a d m   i n i t   g e n e r a t e s   c o n t a i n s   a   c e r t i f i c a t e   w i t h   S u b j e c t :   O   =   k u b e a d m : c l u s t e r - a d m i n s ,   C N   =   k u b e r n e t e s - a d m i n .   T h e   g r o u p   k u b e a d m : c l u s t e r - a d m i n s   i s   b o u n d   t o   t h e   b u i l t - i n   c l u s t e r - a d m i n   C l u s t e r R o l e .   D o   n o t   s h a r e   t h e   a d m i n . c o n f   f i l e   w i t h   a n y o n e .   k u b e a d m   i n i t   g e n e r a t e s   a n o t h e r   k u b e c o n f i g   f i l e   s u p e r - a d m i n . c o n f   t h a t   c o n t a i n s   a   c e r t i f i c a t e   w i t h   S u b j e c t :   O   =   s y s t e m : m a s t e r s ,   C N   =   k u b e r n e t e s - s u p e r - a d m i n .   s y s t e m : m a s t e r s   i s   a   b r e a k - g l a s s ,   s u p e r   u s e r   g r o u p   t h a t   b y p a s s e s   t h e   a u t h o r i z a t i o n   l a y e r   ( f o r   e x a m p l e   R B A C ) .   D o   n o t   s h a r e   t h e   s u p e r - a d m i n . c o n f   f i l e   w i t h   a n y o n e .   I t   i s   r e c o m m e n d e d   t o   m o v e   t h e   f i l e   t o   a   s a f e   l o c a t i o n .   S e e   G e n e r a t i n g   k u b e c o n f i g   f i l e s   f o r   a d d i t i o n a l   u s e r s   o n   h o w   t o   u s e   k u b e a d m   k u b e c o n f i g   u s e r   t o   g e n e r a t e   k u b e c o n f i g   f i l e s   f o r   a d d i t i o n a l   u s e r s .   M a k e   a   r e c o r d   o f   t h e   k u b e a d m   j o i n   c o m m a n d   t h a t   k u b e a d m   i n i t   o u t p u t s .   Y o u   n e e d   t h i s   c o m m a n d   t o   j o i n   n o d e s   t o   y o u r   c l u s t e r .   T h e   t o k e n   i s   u s e d   f o r   m u t u a l   a u t h e n t i c a t i o n   b e t w e e n   t h e   c o n t r o l - p l a n e   n o d e   a n d   t h e   j o i n i


Question: What is Caution:?

Answer: T h i s   s e c t i o n   c o n t a i n s   i m p o r t a n t   i n f o r m a t i o n   a b o u t   n e t w o r k i n g   s e t u p   a n d   d e p l o y m e n t   o r d e r .   R e a d   a l l   o f   t h i s   a d v i c e   c a r e f u l l y   b e f o r e   p r o c e e d i n g .   Y o u   m u s t   d e p l o y   a   C o n t a i n e r   N e t w o r k   I n t e r f a c e   ( C N I )   b a s e d   P o d   n e t w o r k   a d d - o n   s o   t h a t   y o u r   P o d s   c a n   c o m m u n i c a t e   w i t h   e a c h   o t h e r .   C l u s t e r   D N S   ( C o r e D N S )   w i l l   n o t   s t a r t   u p   b e f o r e   a   n e t w o r k   i s   i n s t a l l e d .   T a k e   c a r e   t h a t   y o u r   P o d   n e t w o r k   m u s t   n o t   o v e r l a p   w i t h   a n y   o f   t h e   h o s t   n e t w o r k s :   y o u   a r e   l i k e l y   t o   s e e   p r o b l e m s   i f   t h e r e   i s   a n y   o v e r l a p .   ( I f   y o u   f i n d   a   c o l l i s i o n   b e t w e e n   y o u r   n e t w o r k   p l u g i n ' s   p r e f e r r e d   P o d   n e t w o r k   a n d   s o m e   o f   y o u r   h o s t   n e t w o r k s ,   y o u   s h o u l d   t h i n k   o f   a   s u i t a b l e   C I D R   b l o c k   t o   u s e   i n s t e a d ,   t h e n   u s e   t h a t   d u r i n g   k u b e a d m   i n i t   w i t h   - - p o d - n e t w o r k - c i d r   a n d   a s   a   r e p l a c e m e n t   i n   y o u r   n e t w o r k   p l u g i n ' s   Y A M L ) . B y   d e f a u l t ,   k u b e a d m   s e t s   u p   y o u r   c l u s t e r   t o   u s e   a n d   e n f o r c e   u s e   o f   R B A C   ( r o l e   b a s e d   a c c e s s   c o n t r o l ) .   M a k e   s u r e   t h a t   y o u r   P o d   n e t w o r k   p l u g i n   s u p p o r t s   R B A C ,   a n d   s o   d o   a n y   m a n i f e s t s   t h a t   y o u   u s e   t o   d e p l o y   i t . I f   y o u   w a n t   t o   u s e   I P v 6 - - e i t h e r   d u a l - s t a c


Question: What is Note:?

Answer: S e v e r a l   e x t e r n a l   p r o j e c t s   p r o v i d e   K u b e r n e t e s   P o d   n e t w o r k s   u s i n g   C N I ,   s o m e   o f   w h i c h   a l s o   s u p p o r t   N e t w o r k   P o l i c y .   S e e   a   l i s t   o f   a d d - o n s   t h a t   i m p l e m e n t   t h e   K u b e r n e t e s   n e t w o r k i n g   m o d e l .   P l e a s e   r e f e r   t o   t h e   I n s t a l l i n g   A d d o n s   p a g e   f o r   a   n o n - e x h a u s t i v e   l i s t   o f   n e t w o r k i n g   a d d o n s   s u p p o r t e d   b y   K u b e r n e t e s .   Y o u   c a n   i n s t a l l   a   P o d   n e t w o r k   a d d - o n   w i t h   t h e   f o l l o w i n g   c o m m a n d   o n   t h e   c o n t r o l - p l a n e   n o d e   o r   a   n o d e   t h a t   h a s   t h e   k u b e c o n f i g   c r e d e n t i a l s :   k u b e c t l   a p p l y   - f   < a d d - o n . y a m l >


Question: What is Note:?

Answer: Y o u   c a n   i n s t a l l   o n l y   o n e   P o d   n e t w o r k   p e r   c l u s t e r .   O n c e   a   P o d   n e t w o r k   h a s   b e e n   i n s t a l l e d ,   y o u   c a n   c o n f i r m   t h a t   i t   i s   w o r k i n g   b y   c h e c k i n g   t h a t   t h e   C o r e D N S   P o d   i s   R u n n i n g   i n   t h e   o u t p u t   o f   k u b e c t l   g e t   p o d s   - - a l l - n a m e s p a c e s .   A n d   o n c e   t h e   C o r e D N S   P o d   i s   u p   a n d   r u n n i n g ,   y o u   c a n   c o n t i n u e   b y   j o i n i n g   y o u r   n o d e s .   I f   y o u r   n e t w o r k   i s   n o t   w o r k i n g   o r   C o r e D N S   i s   n o t   i n   t h e   R u n n i n g   s t a t e ,   c h e c k   o u t   t h e   t r o u b l e s h o o t i n g   g u i d e   f o r   k u b e a d m .


Question: What is Managed node labels?

Answer: B y   d e f a u l t ,   k u b e a d m   e n a b l e s   t h e   N o d e R e s t r i c t i o n   a d m i s s i o n   c o n t r o l l e r   t h a t   r e s t r i c t s   w h a t   l a b e l s   c a n   b e   s e l f - a p p l i e d   b y   k u b e l e t s   o n   n o d e   r e g i s t r a t i o n .   T h e   a d m i s s i o n   c o n t r o l l e r   d o c u m e n t a t i o n   c o v e r s   w h a t   l a b e l s   a r e   p e r m i t t e d   t o   b e   u s e d   w i t h   t h e   k u b e l e t   - - n o d e - l a b e l s   o p t i o n .   T h e   n o d e - r o l e . k u b e r n e t e s . i o / c o n t r o l - p l a n e   l a b e l   i s   s u c h   a   r e s t r i c t e d   l a b e l   a n d   k u b e a d m   m a n u a l l y   a p p l i e s   i t   u s i n g   a   p r i v i l e g e d   c l i e n t   a f t e r   a   n o d e   h a s   b e e n   c r e a t e d .   T o   d o   t h a t   m a n u a l l y   y o u   c a n   d o   t h e   s a m e   b y   u s i n g   k u b e c t l   l a b e l   a n d   e n s u r e   i t   i s   u s i n g   a   p r i v i l e g e d   k u b e c o n f i g   s u c h   a s   t h e   k u b e a d m   m a n a g e d   / e t c / k u b e r n e t e s / a d m i n . c o n f .


Question: What is Control plane node isolation?

Answer: B y   d e f a u l t ,   y o u r   c l u s t e r   w i l l   n o t   s c h e d u l e   P o d s   o n   t h e   c o n t r o l   p l a n e   n o d e s   f o r   s e c u r i t y   r e a s o n s .   I f   y o u   w a n t   t o   b e   a b l e   t o   s c h e d u l e   P o d s   o n   t h e   c o n t r o l   p l a n e   n o d e s ,   f o r   e x a m p l e   f o r   a   s i n g l e   m a c h i n e   K u b e r n e t e s   c l u s t e r ,   r u n :   k u b e c t l   t a i n t   n o d e s   - - a l l   n o d e - r o l e . k u b e r n e t e s . i o / c o n t r o l - p l a n e -   T h e   o u t p u t   w i l l   l o o k   s o m e t h i n g   l i k e :   n o d e   " t e s t - 0 1 "   u n t a i n t e d   . . .   T h i s   w i l l   r e m o v e   t h e   n o d e - r o l e . k u b e r n e t e s . i o / c o n t r o l - p l a n e : N o S c h e d u l e   t a i n t   f r o m   a n y   n o d e s   t h a t   h a v e   i t ,   i n c l u d i n g   t h e   c o n t r o l   p l a n e   n o d e s ,   m e a n i n g   t h a t   t h e   s c h e d u l e r   w i l l   t h e n   b e   a b l e   t o   s c h e d u l e   P o d s   e v e r y w h e r e .   A d d i t i o n a l l y ,   y o u   c a n   e x e c u t e   t h e   f o l l o w i n g   c o m m a n d   t o   r e m o v e   t h e   n o d e . k u b e r n e t e s . i o / e x c l u d e - f r o m - e x t e r n a l - l o a d - b a l a n c e r s   l a b e l   f r o m   t h e   c o n t r o l   p l a n e   n o d e ,   w h i c h   e x c l u d e s   i t   f r o m   t h e   l i s t   o f   b a c k e n d   s e r v e r s :   k u b e c t l   l a b e l   n o d e s   - - a l l   n o d e . k u b e r n e t e s . i o / e x c l u d e - f r o m - e x t e r n a l - l o a d - b a l a n c e r s -


Question: What is Adding more control plane nodes?

Answer: S e e   C r e a t i n g   H i g h l y   A v a i l a b l e   C l u s t e r s   w i t h   k u b e a d m   f o r   s t e p s   o n   c r e a t i n g   a   h i g h   a v a i l a b i l i t y   k u b e a d m   c l u s t e r   b y   a d d i n g   m o r e   c o n t r o l   p l a n e   n o d e s .


Question: What is Adding worker nodes?

Answer: T h e   w o r k e r   n o d e s   a r e   w h e r e   y o u r   w o r k l o a d s   r u n .   T h e   f o l l o w i n g   p a g e s   s h o w   h o w   t o   a d d   L i n u x   a n d   W i n d o w s   w o r k e r   n o d e s   t o   t h e   c l u s t e r   b y   u s i n g   t h e   k u b e a d m   j o i n   c o m m a n d :   A d d i n g   L i n u x   w o r k e r   n o d e s A d d i n g   W i n d o w s   w o r k e r   n o d e s


Question: What is (Optional) Controlling your cluster from machines other than the control-plane node?

Answer: I n   o r d e r   t o   g e t   a   k u b e c t l   o n   s o m e   o t h e r   c o m p u t e r   ( e . g .   l a p t o p )   t o   t a l k   t o   y o u r   c l u s t e r ,   y o u   n e e d   t o   c o p y   t h e   a d m i n i s t r a t o r   k u b e c o n f i g   f i l e   f r o m   y o u r   c o n t r o l - p l a n e   n o d e   t o   y o u r   w o r k s t a t i o n   l i k e   t h i s :   s c p   r o o t @ < c o n t r o l - p l a n e - h o s t > : / e t c / k u b e r n e t e s / a d m i n . c o n f   .   k u b e c t l   - - k u b e c o n f i g   . / a d m i n . c o n f   g e t   n o d e s


Question: What is Note:?

Answer: T h e   e x a m p l e   a b o v e   a s s u m e s   S S H   a c c e s s   i s   e n a b l e d   f o r   r o o t .   I f   t h a t   i s   n o t   t h e   c a s e ,   y o u   c a n   c o p y   t h e   a d m i n . c o n f   f i l e   t o   b e   a c c e s s i b l e   b y   s o m e   o t h e r   u s e r   a n d   s c p   u s i n g   t h a t   o t h e r   u s e r   i n s t e a d .   T h e   a d m i n . c o n f   f i l e   g i v e s   t h e   u s e r   s u p e r u s e r   p r i v i l e g e s   o v e r   t h e   c l u s t e r .   T h i s   f i l e   s h o u l d   b e   u s e d   s p a r i n g l y .   F o r   n o r m a l   u s e r s ,   i t ' s   r e c o m m e n d e d   t o   g e n e r a t e   a n   u n i q u e   c r e d e n t i a l   t o   w h i c h   y o u   g r a n t   p r i v i l e g e s .   Y o u   c a n   d o   t h i s   w i t h   t h e   k u b e a d m   k u b e c o n f i g   u s e r   - - c l i e n t - n a m e   < C N >   c o m m a n d .   T h a t   c o m m a n d   w i l l   p r i n t   o u t   a   K u b e C o n f i g   f i l e   t o   S T D O U T   w h i c h   y o u   s h o u l d   s a v e   t o   a   f i l e   a n d   d i s t r i b u t e   t o   y o u r   u s e r .   A f t e r   t h a t ,   g r a n t   p r i v i l e g e s   b y   u s i n g   k u b e c t l   c r e a t e   ( c l u s t e r ) r o l e b i n d i n g .


Question: What is (Optional) Proxying API Server to localhost?

Answer: I f   y o u   w a n t   t o   c o n n e c t   t o   t h e   A P I   S e r v e r   f r o m   o u t s i d e   t h e   c l u s t e r ,   y o u   c a n   u s e   k u b e c t l   p r o x y :   s c p   r o o t @ < c o n t r o l - p l a n e - h o s t > : / e t c / k u b e r n e t e s / a d m i n . c o n f   .   k u b e c t l   - - k u b e c o n f i g   . / a d m i n . c o n f   p r o x y   Y o u   c a n   n o w   a c c e s s   t h e   A P I   S e r v e r   l o c a l l y   a t   h t t p : / / l o c a l h o s t : 8 0 0 1 / a p i / v 1


Question: What is Clean up?

Answer: I f   y o u   u s e d   d i s p o s a b l e   s e r v e r s   f o r   y o u r   c l u s t e r ,   f o r   t e s t i n g ,   y o u   c a n   s w i t c h   t h o s e   o f f   a n d   d o   n o   f u r t h e r   c l e a n   u p .   Y o u   c a n   u s e   k u b e c t l   c o n f i g   d e l e t e - c l u s t e r   t o   d e l e t e   y o u r   l o c a l   r e f e r e n c e s   t o   t h e   c l u s t e r .   H o w e v e r ,   i f   y o u   w a n t   t o   d e p r o v i s i o n   y o u r   c l u s t e r   m o r e   c l e a n l y ,   y o u   s h o u l d   f i r s t   d r a i n   t h e   n o d e   a n d   m a k e   s u r e   t h a t   t h e   n o d e   i s   e m p t y ,   t h e n   d e c o n f i g u r e   t h e   n o d e .


Question: What is Remove the node?

Answer: T a l k i n g   t o   t h e   c o n t r o l - p l a n e   n o d e   w i t h   t h e   a p p r o p r i a t e   c r e d e n t i a l s ,   r u n :   k u b e c t l   d r a i n   < n o d e   n a m e >   - - d e l e t e - e m p t y d i r - d a t a   - - f o r c e   - - i g n o r e - d a e m o n s e t s   B e f o r e   r e m o v i n g   t h e   n o d e ,   r e s e t   t h e   s t a t e   i n s t a l l e d   b y   k u b e a d m :   k u b e a d m   r e s e t   T h e   r e s e t   p r o c e s s   d o e s   n o t   r e s e t   o r   c l e a n   u p   i p t a b l e s   r u l e s   o r   I P V S   t a b l e s .   I f   y o u   w i s h   t o   r e s e t   i p t a b l e s ,   y o u   m u s t   d o   s o   m a n u a l l y :   i p t a b l e s   - F   & &   i p t a b l e s   - t   n a t   - F   & &   i p t a b l e s   - t   m a n g l e   - F   & &   i p t a b l e s   - X   I f   y o u   w a n t   t o   r e s e t   t h e   I P V S   t a b l e s ,   y o u   m u s t   r u n   t h e   f o l l o w i n g   c o m m a n d :   i p v s a d m   - C   N o w   r e m o v e   t h e   n o d e :   k u b e c t l   d e l e t e   n o d e   < n o d e   n a m e >   I f   y o u   w i s h   t o   s t a r t   o v e r ,   r u n   k u b e a d m   i n i t   o r   k u b e a d m   j o i n   w i t h   t h e   a p p r o p r i a t e   a r g u m e n t s .


Question: What is Clean up the control plane?

Answer: Y o u   c a n   u s e   k u b e a d m   r e s e t   o n   t h e   c o n t r o l   p l a n e   h o s t   t o   t r i g g e r   a   b e s t - e f f o r t   c l e a n   u p .   S e e   t h e   k u b e a d m   r e s e t   r e f e r e n c e   d o c u m e n t a t i o n   f o r   m o r e   i n f o r m a t i o n   a b o u t   t h i s   s u b c o m m a n d   a n d   i t s   o p t i o n s .


Question: What is Version skew policy?

Answer: W h i l e   k u b e a d m   a l l o w s   v e r s i o n   s k e w   a g a i n s t   s o m e   c o m p o n e n t s   t h a t   i t   m a n a g e s ,   i t   i s   r e c o m m e n d e d   t h a t   y o u   m a t c h   t h e   k u b e a d m   v e r s i o n   w i t h   t h e   v e r s i o n s   o f   t h e   c o n t r o l   p l a n e   c o m p o n e n t s ,   k u b e - p r o x y   a n d   k u b e l e t .


Question: What is kubeadm's skew against the Kubernetes version?

Answer: k u b e a d m   c a n   b e   u s e d   w i t h   K u b e r n e t e s   c o m p o n e n t s   t h a t   a r e   t h e   s a m e   v e r s i o n   a s   k u b e a d m   o r   o n e   v e r s i o n   o l d e r .   T h e   K u b e r n e t e s   v e r s i o n   c a n   b e   s p e c i f i e d   t o   k u b e a d m   b y   u s i n g   t h e   - - k u b e r n e t e s - v e r s i o n   f l a g   o f   k u b e a d m   i n i t   o r   t h e   C l u s t e r C o n f i g u r a t i o n . k u b e r n e t e s V e r s i o n   f i e l d   w h e n   u s i n g   - - c o n f i g .   T h i s   o p t i o n   w i l l   c o n t r o l   t h e   v e r s i o n s   o f   k u b e - a p i s e r v e r ,   k u b e - c o n t r o l l e r - m a n a g e r ,   k u b e - s c h e d u l e r   a n d   k u b e - p r o x y .   E x a m p l e :   k u b e a d m   i s   a t   1 . 3 4 k u b e r n e t e s V e r s i o n   m u s t   b e   a t   1 . 3 4   o r   1 . 3 3


Question: What is kubeadm's skew against the kubelet?

Answer: S i m i l a r l y   t o   t h e   K u b e r n e t e s   v e r s i o n ,   k u b e a d m   c a n   b e   u s e d   w i t h   a   k u b e l e t   v e r s i o n   t h a t   i s   t h e   s a m e   v e r s i o n   a s   k u b e a d m   o r   t h r e e   v e r s i o n s   o l d e r .   E x a m p l e :   k u b e a d m   i s   a t   1 . 3 4 k u b e l e t   o n   t h e   h o s t   m u s t   b e   a t   1 . 3 4 ,   1 . 3 3 ,   1 . 3 2   o r   1 . 3 1


Question: What is kubeadm's skew against kubeadm?

Answer: T h e r e   a r e   c e r t a i n   l i m i t a t i o n s   o n   h o w   k u b e a d m   c o m m a n d s   c a n   o p e r a t e   o n   e x i s t i n g   n o d e s   o r   w h o l e   c l u s t e r s   m a n a g e d   b y   k u b e a d m .   I f   n e w   n o d e s   a r e   j o i n e d   t o   t h e   c l u s t e r ,   t h e   k u b e a d m   b i n a r y   u s e d   f o r   k u b e a d m   j o i n   m u s t   m a t c h   t h e   l a s t   v e r s i o n   o f   k u b e a d m   u s e d   t o   e i t h e r   c r e a t e   t h e   c l u s t e r   w i t h   k u b e a d m   i n i t   o r   t o   u p g r a d e   t h e   s a m e   n o d e   w i t h   k u b e a d m   u p g r a d e .   S i m i l a r   r u l e s   a p p l y   t o   t h e   r e s t   o f   t h e   k u b e a d m   c o m m a n d s   w i t h   t h e   e x c e p t i o n   o f   k u b e a d m   u p g r a d e .   E x a m p l e   f o r   k u b e a d m   j o i n :   k u b e a d m   v e r s i o n   1 . 3 4   w a s   u s e d   t o   c r e a t e   a   c l u s t e r   w i t h   k u b e a d m   i n i t J o i n i n g   n o d e s   m u s t   u s e   a   k u b e a d m   b i n a r y   t h a t   i s   a t   v e r s i o n   1 . 3 4   N o d e s   t h a t   a r e   b e i n g   u p g r a d e d   m u s t   u s e   a   v e r s i o n   o f   k u b e a d m   t h a t   i s   t h e   s a m e   M I N O R   v e r s i o n   o r   o n e   M I N O R   v e r s i o n   n e w e r   t h a n   t h e   v e r s i o n   o f   k u b e a d m   u s e d   f o r   m a n a g i n g   t h e   n o d e .   E x a m p l e   f o r   k u b e a d m   u p g r a d e :   k u b e a d m   v e r s i o n   1 . 3 3   w a s   u s e d   t o   c r e a t e   o r   u p g r a d e   t h e   n o d e T h e   v e r s i o n   o f   k u b e a d m   u s e d   f o r   u p g r a d i n g   t h e   n o d e   m u s t   b e   a t   1 . 3 3   o r   1 . 3 4   T o   l e a r n   m o r e   a b o u t   t h e   v e r s i o n   s k e w   b e t w e e n   t h e   d i f f e r e n t   K u b e r n e t


Question: What is Cluster resilience?

Answer: T h e   c l u s t e r   c r e a t e d   h e r e   h a s   a   s i n g l e   c o n t r o l - p l a n e   n o d e ,   w i t h   a   s i n g l e   e t c d   d a t a b a s e   r u n n i n g   o n   i t .   T h i s   m e a n s   t h a t   i f   t h e   c o n t r o l - p l a n e   n o d e   f a i l s ,   y o u r   c l u s t e r   m a y   l o s e   d a t a   a n d   m a y   n e e d   t o   b e   r e c r e a t e d   f r o m   s c r a t c h .   W o r k a r o u n d s :   R e g u l a r l y   b a c k   u p   e t c d .   T h e   e t c d   d a t a   d i r e c t o r y   c o n f i g u r e d   b y   k u b e a d m   i s   a t   / v a r / l i b / e t c d   o n   t h e   c o n t r o l - p l a n e   n o d e . U s e   m u l t i p l e   c o n t r o l - p l a n e   n o d e s .   Y o u   c a n   r e a d   O p t i o n s   f o r   H i g h l y   A v a i l a b l e   t o p o l o g y   t o   p i c k   a   c l u s t e r   t o p o l o g y   t h a t   p r o v i d e s   h i g h - a v a i l a b i l i t y .   R e g u l a r l y   b a c k   u p   e t c d .   T h e   e t c d   d a t a   d i r e c t o r y   c o n f i g u r e d   b y   k u b e a d m   i s   a t   / v a r / l i b / e t c d   o n   t h e   c o n t r o l - p l a n e   n o d e .   U s e   m u l t i p l e   c o n t r o l - p l a n e   n o d e s .   Y o u   c a n   r e a d   O p t i o n s   f o r   H i g h l y   A v a i l a b l e   t o p o l o g y   t o   p i c k   a   c l u s t e r   t o p o l o g y   t h a t   p r o v i d e s   h i g h - a v a i l a b i l i t y .


Question: What is Platform compatibility?

Answer: k u b e a d m   d e b / r p m   p a c k a g e s   a n d   b i n a r i e s   a r e   b u i l t   f o r   a m d 6 4 ,   a r m   ( 3 2 - b i t ) ,   a r m 6 4 ,   p p c 6 4 l e ,   a n d   s 3 9 0 x   f o l l o w i n g   t h e   m u l t i - p l a t f o r m   p r o p o s a l .   M u l t i p l a t f o r m   c o n t a i n e r   i m a g e s   f o r   t h e   c o n t r o l   p l a n e   a n d   a d d o n s   a r e   a l s o   s u p p o r t e d   s i n c e   v 1 . 1 2 .   O n l y   s o m e   o f   t h e   n e t w o r k   p r o v i d e r s   o f f e r   s o l u t i o n s   f o r   a l l   p l a t f o r m s .   P l e a s e   c o n s u l t   t h e   l i s t   o f   n e t w o r k   p r o v i d e r s   a b o v e   o r   t h e   d o c u m e n t a t i o n   f r o m   e a c h   p r o v i d e r   t o   f i g u r e   o u t   w h e t h e r   t h e   p r o v i d e r   s u p p o r t s   y o u r   c h o s e n   p l a t f o r m .


Question: What is Troubleshooting?

Answer: I f   y o u   a r e   r u n n i n g   i n t o   d i f f i c u l t i e s   w i t h   k u b e a d m ,   p l e a s e   c o n s u l t   o u r   t r o u b l e s h o o t i n g   d o c s .


Question: What is What's next?

Answer: V e r i f y   t h a t   y o u r   c l u s t e r   i s   r u n n i n g   p r o p e r l y   w i t h   S o n o b u o y S e e   U p g r a d i n g   k u b e a d m   c l u s t e r s   f o r   d e t a i l s   a b o u t   u p g r a d i n g   y o u r   c l u s t e r   u s i n g   k u b e a d m . L e a r n   a b o u t   a d v a n c e d   k u b e a d m   u s a g e   i n   t h e   k u b e a d m   r e f e r e n c e   d o c u m e n t a t i o n L e a r n   m o r e   a b o u t   K u b e r n e t e s   c o n c e p t s   a n d   k u b e c t l . S e e   t h e   C l u s t e r   N e t w o r k i n g   p a g e   f o r   a   b i g g e r   l i s t   o f   P o d   n e t w o r k   a d d - o n s . S e e   t h e   l i s t   o f   a d d - o n s   t o   e x p l o r e   o t h e r   a d d - o n s ,   i n c l u d i n g   t o o l s   f o r   l o g g i n g ,   m o n i t o r i n g ,   n e t w o r k   p o l i c y ,   v i s u a l i z a t i o n   &   c o n t r o l   o f   y o u r   K u b e r n e t e s   c l u s t e r . C o n f i g u r e   h o w   y o u r   c l u s t e r   h a n d l e s   l o g s   f o r   c l u s t e r   e v e n t s   a n d   f r o m   a p p l i c a t i o n s   r u n n i n g   i n   P o d s .   S e e   L o g g i n g   A r c h i t e c t u r e   f o r   a n   o v e r v i e w   o f   w h a t   i s   i n v o l v e d .


Question: What is kubectl attach?

Answer: kubectl attachSynopsisAttach to a process that is already running inside an existing container.kubectl attach (POD | TYPE/NAME) -c CONTAINER Examples # Get output from running pod mypod; use the 'kubectl.kubernetes.io/default-container' annotation # for selecting the container to be attached or the first container in the pod will be chosen kubectl attach mypod # Get output from ruby-container from pod mypod kubectl attach mypod -c ruby-container # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client kubectl attach mypod -c ruby-container -i -t # Get output from the first pod of a replica set named nginx kubectl attach rs/nginx Options-c, --container stringContainer name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen-h, --helphelp for attach--pod-running-timeout duration Default: 1m0sThe length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running-q, --quietOnly print output from the remote session-i, --stdinPass stdin to the container-t, --ttyStdin is a TTYParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't


Question: How does kubectl attach work?

Answer: kubectl attachSynopsisAttach to a process that is already running inside an existing container.kubectl attach (POD | TYPE/NAME) -c CONTAINER Examples # Get output from running pod mypod; use the 'kubectl.kubernetes.io/default-container' annotation # for selecting the container to be attached or the first container in the pod will be chosen kubectl attach mypod # Get output from ruby-container from pod mypod kubectl attach mypod -c ruby-container # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client kubectl attach mypod -c ruby-container -i -t # Get output from the first pod of a replica set named nginx kubectl attach rs/nginx Options-c, --container stringContainer name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen-h, --helphelp for attach--pod-running-timeout duration Default: 1m0sThe length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running-q, --quietOnly print output from the remote session-i, --stdinPass stdin to the container-t, --ttyStdin is a TTYParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't


Question: When would you use kubectl attach?

Answer: kubectl attachSynopsisAttach to a process that is already running inside an existing container.kubectl attach (POD | TYPE/NAME) -c CONTAINER Examples # Get output from running pod mypod; use the 'kubectl.kubernetes.io/default-container' annotation # for selecting the container to be attached or the first container in the pod will be chosen kubectl attach mypod # Get output from ruby-container from pod mypod kubectl attach mypod -c ruby-container # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client kubectl attach mypod -c ruby-container -i -t # Get output from the first pod of a replica set named nginx kubectl attach rs/nginx Options-c, --container stringContainer name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen-h, --helphelp for attach--pod-running-timeout duration Default: 1m0sThe length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running-q, --quietOnly print output from the remote session-i, --stdinPass stdin to the container-t, --ttyStdin is a TTYParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't


Question: What are the benefits of kubectl attach?

Answer: kubectl attachSynopsisAttach to a process that is already running inside an existing container.kubectl attach (POD | TYPE/NAME) -c CONTAINER Examples # Get output from running pod mypod; use the 'kubectl.kubernetes.io/default-container' annotation # for selecting the container to be attached or the first container in the pod will be chosen kubectl attach mypod # Get output from ruby-container from pod mypod kubectl attach mypod -c ruby-container # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client kubectl attach mypod -c ruby-container -i -t # Get output from the first pod of a replica set named nginx kubectl attach rs/nginx Options-c, --container stringContainer name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen-h, --helphelp for attach--pod-running-timeout duration Default: 1m0sThe length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running-q, --quietOnly print output from the remote session-i, --stdinPass stdin to the container-t, --ttyStdin is a TTYParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't


Question: What is Synopsis?

Answer: A t t a c h   t o   a   p r o c e s s   t h a t   i s   a l r e a d y   r u n n i n g   i n s i d e   a n   e x i s t i n g   c o n t a i n e r .   k u b e c t l   a t t a c h   ( P O D   |   T Y P E / N A M E )   - c   C O N T A I N E R


Question: What is Examples?

Answer: #   G e t   o u t p u t   f r o m   r u n n i n g   p o d   m y p o d ;   u s e   t h e   ' k u b e c t l . k u b e r n e t e s . i o / d e f a u l t - c o n t a i n e r '   a n n o t a t i o n   #   f o r   s e l e c t i n g   t h e   c o n t a i n e r   t o   b e   a t t a c h e d   o r   t h e   f i r s t   c o n t a i n e r   i n   t h e   p o d   w i l l   b e   c h o s e n   k u b e c t l   a t t a c h   m y p o d   #   G e t   o u t p u t   f r o m   r u b y - c o n t a i n e r   f r o m   p o d   m y p o d   k u b e c t l   a t t a c h   m y p o d   - c   r u b y - c o n t a i n e r   #   S w i t c h   t o   r a w   t e r m i n a l   m o d e ;   s e n d s   s t d i n   t o   ' b a s h '   i n   r u b y - c o n t a i n e r   f r o m   p o d   m y p o d   #   a n d   s e n d s   s t d o u t / s t d e r r   f r o m   ' b a s h '   b a c k   t o   t h e   c l i e n t   k u b e c t l   a t t a c h   m y p o d   - c   r u b y - c o n t a i n e r   - i   - t   #   G e t   o u t p u t   f r o m   t h e   f i r s t   p o d   o f   a   r e p l i c a   s e t   n a m e d   n g i n x   k u b e c t l   a t t a c h   r s / n g i n x