Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s


Question: What is Writing and reading a termination message?

Answer: I n   t h i s   e x e r c i s e ,   y o u   c r e a t e   a   P o d   t h a t   r u n s   o n e   c o n t a i n e r .   T h e   m a n i f e s t   f o r   t h a t   P o d   s p e c i f i e s   a   c o m m a n d   t h a t   r u n s   w h e n   t h e   c o n t a i n e r   s t a r t s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e r m i n a t i o n - d e m o   s p e c :   c o n t a i n e r s :   -   n a m e :   t e r m i n a t i o n - d e m o - c o n t a i n e r   i m a g e :   d e b i a n   c o m m a n d :   [ " / b i n / s h " ]   a r g s :   [ " - c " ,   " s l e e p   1 0   & &   e c h o   S l e e p   e x p i r e d   >   / d e v / t e r m i n a t i o n - l o g " ]   C r e a t e   a   P o d   b a s e d   o n   t h e   Y A M L   c o n f i g u r a t i o n   f i l e : k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d e b u g / t e r m i n a t i o n . y a m l   I n   t h e   Y A M L   f i l e ,   i n   t h e   c o m m a n d   a n d   a r g s   f i e l d s ,   y o u   c a n   s e e   t h a t   t h e   c o n t a i n e r   s l e e p s   f o r   1 0   s e c o n d s   a n d   t h e n   w r i t e s   " S l e e p   e x p i r e d "   t o   t h e   / d e v / t e r m i n a t i o n - l o g   f i l e .   A f t e r   t h e   c o n t a i n e r   w r i t e s   t h e   " S l e e p   e x p i r e d "   m e s s a g e ,   i t   t e r m i n a t e s . D i s p l a y   i n f o r m a t i o n   a b o u t   t h e   P o d : k u b e c t l   g e t   p o d   t e r m i n a t i o n - d e m o   R e p e a t   t h e   p r e c e d i n g   c o m m a n d   u n t i l   t h e   P o d   i s   n o   l o n g e r   r u n n i n g . D i s p l a y   d e t a i l e d   i n f o r m a t i o n   a b o u t   t h e   P o d : k u b e c t l   g e t   p o d   t e r m i n a t i o n - d e m o   - - o u t p u t = y a m l   T h e   o u t p u t   i n c l u d e s   t h e   " S l e e p   e x p i r e d "   m e s s a g e : a p i V e r s i o n :   v 1   k i n d


Question: What is Customizing the termination message?

Answer: K u b e r n e t e s   r e t r i e v e s   t e r m i n a t i o n   m e s s a g e s   f r o m   t h e   t e r m i n a t i o n   m e s s a g e   f i l e   s p e c i f i e d   i n   t h e   t e r m i n a t i o n M e s s a g e P a t h   f i e l d   o f   a   C o n t a i n e r ,   w h i c h   h a s   a   d e f a u l t   v a l u e   o f   / d e v / t e r m i n a t i o n - l o g .   B y   c u s t o m i z i n g   t h i s   f i e l d ,   y o u   c a n   t e l l   K u b e r n e t e s   t o   u s e   a   d i f f e r e n t   f i l e .   K u b e r n e t e s   u s e   t h e   c o n t e n t s   f r o m   t h e   s p e c i f i e d   f i l e   t o   p o p u l a t e   t h e   C o n t a i n e r ' s   s t a t u s   m e s s a g e   o n   b o t h   s u c c e s s   a n d   f a i l u r e .   T h e   t e r m i n a t i o n   m e s s a g e   i s   i n t e n d e d   t o   b e   b r i e f   f i n a l   s t a t u s ,   s u c h   a s   a n   a s s e r t i o n   f a i l u r e   m e s s a g e .   T h e   k u b e l e t   t r u n c a t e s   m e s s a g e s   t h a t   a r e   l o n g e r   t h a n   4 0 9 6   b y t e s .   T h e   t o t a l   m e s s a g e   l e n g t h   a c r o s s   a l l   c o n t a i n e r s   i s   l i m i t e d   t o   1 2 K i B ,   d i v i d e d   e q u a l l y   a m o n g   e a c h   c o n t a i n e r .   F o r   e x a m p l e ,   i f   t h e r e   a r e   1 2   c o n t a i n e r s   ( i n i t C o n t a i n e r s   o r   c o n t a i n e r s ) ,   e a c h   h a s   1 0 2 4   b y t e s   o f   a v a i l a b l e   t e r m i n a t i o n   m e s s a g e   s p a c e .   T h e   d e f a u l t   t e r m i n a t i o n   m e s s a g e   p a t h   i s   / d e v / t e r m i n a t i o n - l o g .   Y o u   c a n n o t   s e t   t h e   t e r m i n a t i o n   m e s s a g e   p a t h   a f t e r   a   P o d   i s   l a u n c h e d .   I n   t h e   f o l l o w i n g   e x a m p l e ,   t h e   c o n t a i n e r   w r i t e s   t e r m i n a t i o n   m e s s a g e s   t o   / t m p / m y


Question: What is What's next?

Answer: S e e   t h e   t e r m i n a t i o n M e s s a g e P a t h   f i e l d   i n   C o n t a i n e r . S e e   I m a g e P u l l B a c k O f f   i n   I m a g e s . L e a r n   a b o u t   r e t r i e v i n g   l o g s . L e a r n   a b o u t   G o   t e m p l a t e s . L e a r n   a b o u t   P o d   s t a t u s   a n d   P o d   p h a s e . L e a r n   a b o u t   c o n t a i n e r   s t a t e s .


Question: What is Changing the Container Runtime on a Node from Docker Engine to containerd?

Answer: Changing the Container Runtime on a Node from Docker Engine to containerdThis task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. This also covers an example scenario for migrating from dockershim to containerd. Alternative container runtimes can be picked from this page.Before you beginNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Install containerd. For more information see containerd's installation documentation and for specific prerequisite follow the containerd guide.Drain the nodekubectl drain <node-to-drain> --ignore-daemonsets Replace <node-to-drain> with the name of your node you are draining.Stop the Docker daemonsystemctl stop kubelet systemctl disable docker.service --now Install ContainerdFollow the guide for detailed steps to install containerd.Install the containerd.io package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the containerd.io package can be found at Getting started with containerd.Configure containerd:sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml Restart containerd:sudo systemctl restart containerd Start a Powershell session, set $Version to the desired version (ex: $Version="1.4.3"), and then run the following commands:Download containerd:curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .\containerd-windows-amd64.tar.gz Extract and configure:Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force cd $Env:ProgramFiles\containerd\ .\containerd.exe config default | Out-File config.toml -Encoding ascii # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" Start containerd:.\containerd.exe --register-service Start-Service containerd Configure the kubelet to use containerd as its container runtimeEdit the file /var/lib/kubelet/kubeadm-flags.env and add the containerd runtime to the flags; --container-runtime-endpoint=unix:///run/containerd/containerd.sock.Users using kubeadm should be aware that the kubeadm tool stores the host's CRI socket in the/var/lib/kubelet/instance-config.yaml file on each node. You can create this /var/lib/kubelet/instance-config.yaml file on the node.The /va


Question: How does Changing the Container Runtime on a Node from Docker Engine to containerd work?

Answer: Changing the Container Runtime on a Node from Docker Engine to containerdThis task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. This also covers an example scenario for migrating from dockershim to containerd. Alternative container runtimes can be picked from this page.Before you beginNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Install containerd. For more information see containerd's installation documentation and for specific prerequisite follow the containerd guide.Drain the nodekubectl drain <node-to-drain> --ignore-daemonsets Replace <node-to-drain> with the name of your node you are draining.Stop the Docker daemonsystemctl stop kubelet systemctl disable docker.service --now Install ContainerdFollow the guide for detailed steps to install containerd.Install the containerd.io package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the containerd.io package can be found at Getting started with containerd.Configure containerd:sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml Restart containerd:sudo systemctl restart containerd Start a Powershell session, set $Version to the desired version (ex: $Version="1.4.3"), and then run the following commands:Download containerd:curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .\containerd-windows-amd64.tar.gz Extract and configure:Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force cd $Env:ProgramFiles\containerd\ .\containerd.exe config default | Out-File config.toml -Encoding ascii # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" Start containerd:.\containerd.exe --register-service Start-Service containerd Configure the kubelet to use containerd as its container runtimeEdit the file /var/lib/kubelet/kubeadm-flags.env and add the containerd runtime to the flags; --container-runtime-endpoint=unix:///run/containerd/containerd.sock.Users using kubeadm should be aware that the kubeadm tool stores the host's CRI socket in the/var/lib/kubelet/instance-config.yaml file on each node. You can create this /var/lib/kubelet/instance-config.yaml file on the node.The /va


Question: When would you use Changing the Container Runtime on a Node from Docker Engine to containerd?

Answer: Changing the Container Runtime on a Node from Docker Engine to containerdThis task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. This also covers an example scenario for migrating from dockershim to containerd. Alternative container runtimes can be picked from this page.Before you beginNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Install containerd. For more information see containerd's installation documentation and for specific prerequisite follow the containerd guide.Drain the nodekubectl drain <node-to-drain> --ignore-daemonsets Replace <node-to-drain> with the name of your node you are draining.Stop the Docker daemonsystemctl stop kubelet systemctl disable docker.service --now Install ContainerdFollow the guide for detailed steps to install containerd.Install the containerd.io package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the containerd.io package can be found at Getting started with containerd.Configure containerd:sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml Restart containerd:sudo systemctl restart containerd Start a Powershell session, set $Version to the desired version (ex: $Version="1.4.3"), and then run the following commands:Download containerd:curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .\containerd-windows-amd64.tar.gz Extract and configure:Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force cd $Env:ProgramFiles\containerd\ .\containerd.exe config default | Out-File config.toml -Encoding ascii # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" Start containerd:.\containerd.exe --register-service Start-Service containerd Configure the kubelet to use containerd as its container runtimeEdit the file /var/lib/kubelet/kubeadm-flags.env and add the containerd runtime to the flags; --container-runtime-endpoint=unix:///run/containerd/containerd.sock.Users using kubeadm should be aware that the kubeadm tool stores the host's CRI socket in the/var/lib/kubelet/instance-config.yaml file on each node. You can create this /var/lib/kubelet/instance-config.yaml file on the node.The /va


Question: What are the benefits of Changing the Container Runtime on a Node from Docker Engine to containerd?

Answer: Changing the Container Runtime on a Node from Docker Engine to containerdThis task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. This also covers an example scenario for migrating from dockershim to containerd. Alternative container runtimes can be picked from this page.Before you beginNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Install containerd. For more information see containerd's installation documentation and for specific prerequisite follow the containerd guide.Drain the nodekubectl drain <node-to-drain> --ignore-daemonsets Replace <node-to-drain> with the name of your node you are draining.Stop the Docker daemonsystemctl stop kubelet systemctl disable docker.service --now Install ContainerdFollow the guide for detailed steps to install containerd.Install the containerd.io package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the containerd.io package can be found at Getting started with containerd.Configure containerd:sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml Restart containerd:sudo systemctl restart containerd Start a Powershell session, set $Version to the desired version (ex: $Version="1.4.3"), and then run the following commands:Download containerd:curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .\containerd-windows-amd64.tar.gz Extract and configure:Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force cd $Env:ProgramFiles\containerd\ .\containerd.exe config default | Out-File config.toml -Encoding ascii # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" Start containerd:.\containerd.exe --register-service Start-Service containerd Configure the kubelet to use containerd as its container runtimeEdit the file /var/lib/kubelet/kubeadm-flags.env and add the containerd runtime to the flags; --container-runtime-endpoint=unix:///run/containerd/containerd.sock.Users using kubeadm should be aware that the kubeadm tool stores the host's CRI socket in the/var/lib/kubelet/instance-config.yaml file on each node. You can create this /var/lib/kubelet/instance-config.yaml file on the node.The /va


Question: What is Changing the Container Runtime on a Node from Docker Engine to containerd?

Answer: T h i s   t a s k   o u t l i n e s   t h e   s t e p s   n e e d e d   t o   u p d a t e   y o u r   c o n t a i n e r   r u n t i m e   t o   c o n t a i n e r d   f r o m   D o c k e r .   I t   i s   a p p l i c a b l e   f o r   c l u s t e r   o p e r a t o r s   r u n n i n g   K u b e r n e t e s   1 . 2 3   o r   e a r l i e r .   T h i s   a l s o   c o v e r s   a n   e x a m p l e   s c e n a r i o   f o r   m i g r a t i n g   f r o m   d o c k e r s h i m   t o   c o n t a i n e r d .   A l t e r n a t i v e   c o n t a i n e r   r u n t i m e s   c a n   b e   p i c k e d   f r o m   t h i s   p a g e .


Question: What is Before you begin?

Answer: I n s t a l l   c o n t a i n e r d .   F o r   m o r e   i n f o r m a t i o n   s e e   c o n t a i n e r d ' s   i n s t a l l a t i o n   d o c u m e n t a t i o n   a n d   f o r   s p e c i f i c   p r e r e q u i s i t e   f o l l o w   t h e   c o n t a i n e r d   g u i d e .


Question: What is Drain the node?

Answer: k u b e c t l   d r a i n   < n o d e - t o - d r a i n >   - - i g n o r e - d a e m o n s e t s   R e p l a c e   < n o d e - t o - d r a i n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   y o u   a r e   d r a i n i n g .


Question: What is Stop the Docker daemon?

Answer: s y s t e m c t l   s t o p   k u b e l e t   s y s t e m c t l   d i s a b l e   d o c k e r . s e r v i c e   - - n o w


Question: What is Install Containerd?

Answer: F o l l o w   t h e   g u i d e   f o r   d e t a i l e d   s t e p s   t o   i n s t a l l   c o n t a i n e r d .   I n s t a l l   t h e   c o n t a i n e r d . i o   p a c k a g e   f r o m   t h e   o f f i c i a l   D o c k e r   r e p o s i t o r i e s .   I n s t r u c t i o n s   f o r   s e t t i n g   u p   t h e   D o c k e r   r e p o s i t o r y   f o r   y o u r   r e s p e c t i v e   L i n u x   d i s t r i b u t i o n   a n d   i n s t a l l i n g   t h e   c o n t a i n e r d . i o   p a c k a g e   c a n   b e   f o u n d   a t   G e t t i n g   s t a r t e d   w i t h   c o n t a i n e r d . C o n f i g u r e   c o n t a i n e r d : s u d o   m k d i r   - p   / e t c / c o n t a i n e r d   c o n t a i n e r d   c o n f i g   d e f a u l t   |   s u d o   t e e   / e t c / c o n t a i n e r d / c o n f i g . t o m l   R e s t a r t   c o n t a i n e r d : s u d o   s y s t e m c t l   r e s t a r t   c o n t a i n e r d   I n s t a l l   t h e   c o n t a i n e r d . i o   p a c k a g e   f r o m   t h e   o f f i c i a l   D o c k e r   r e p o s i t o r i e s .   I n s t r u c t i o n s   f o r   s e t t i n g   u p   t h e   D o c k e r   r e p o s i t o r y   f o r   y o u r   r e s p e c t i v e   L i n u x   d i s t r i b u t i o n   a n d   i n s t a l l i n g   t h e   c o n t a i n e r d . i o   p a c k a g e   c a n   b e   f o u n d   a t   G e t t i n g   s t a r t e d   w i t h   c o n t a i n e r d . C o n f i g u r e   c o n t a i n e r d : s u d o   m k d i r   - p   / e t c / c o n t a i n e r d   c o n t a i n e r d   c o n f i g   d e f a u l t   |   s u d o   t e e   / e t c / c o n t a i n e r d / c o n f i g . t o m l   R e s t a r t   c o n t a i n e r d : s u d o   s y s t e m c t l   r e s t a r t   c o n t a i n e r d   I n s t a l l   t h e   c o n t a i n e r d . i o   p a c k a g e   f r o m   t h e   o f f i c i a l   D o c k e r   r e p o s i t o r i e s .   I n s t r u c t i o n s   f o r   s e t t i n g   u p


Question: What is Configure the kubelet to use containerd as its container runtime?

Answer: E d i t   t h e   f i l e   / v a r / l i b / k u b e l e t / k u b e a d m - f l a g s . e n v   a n d   a d d   t h e   c o n t a i n e r d   r u n t i m e   t o   t h e   f l a g s ;   - - c o n t a i n e r - r u n t i m e - e n d p o i n t = u n i x : / / / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k .   U s e r s   u s i n g   k u b e a d m   s h o u l d   b e   a w a r e   t h a t   t h e   k u b e a d m   t o o l   s t o r e s   t h e   h o s t ' s   C R I   s o c k e t   i n   t h e   / v a r / l i b / k u b e l e t / i n s t a n c e - c o n f i g . y a m l   f i l e   o n   e a c h   n o d e .   Y o u   c a n   c r e a t e   t h i s   / v a r / l i b / k u b e l e t / i n s t a n c e - c o n f i g . y a m l   f i l e   o n   t h e   n o d e .   T h e   / v a r / l i b / k u b e l e t / i n s t a n c e - c o n f i g . y a m l   f i l e   a l l o w s   s e t t i n g   t h e   c o n t a i n e r R u n t i m e E n d p o i n t   p a r a m e t e r .   Y o u   c a n   s e t   t h i s   p a r a m e t e r ' s   v a l u e   t o   t h e   p a t h   o f   y o u r   c h o s e n   C R I   s o c k e t   ( f o r   e x a m p l e   u n i x : / / / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k ) .


Question: What is Restart the kubelet?

Answer: s y s t e m c t l   s t a r t   k u b e l e t


Question: What is Verify that the node is healthy?

Answer: R u n   k u b e c t l   g e t   n o d e s   - o   w i d e   a n d   c o n t a i n e r d   a p p e a r s   a s   t h e   r u n t i m e   f o r   t h e   n o d e   w e   j u s t   c h a n g e d .


Question: What is Remove Docker Engine?

Answer: I f   t h e   n o d e   a p p e a r s   h e a l t h y ,   r e m o v e   D o c k e r .   s u d o   y u m   r e m o v e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   y u m   r e m o v e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   a p t - g e t   p u r g e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   a p t - g e t   p u r g e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   d n f   r e m o v e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   d n f   r e m o v e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   a p t - g e t   p u r g e   d o c k e r - c e   d o c k e r - c e - c l i   s u d o   a p t - g e t   p u r g e   d o c k e r - c e   d o c k e r - c e - c l i   T h e   p r e c e d i n g   c o m m a n d s   d o n ' t   r e m o v e   i m a g e s ,   c o n t a i n e r s ,   v o l u m e s ,   o r   c u s t o m i z e d   c o n f i g u r a t i o n   f i l e s   o n   y o u r   h o s t .   T o   d e l e t e   t h e m ,   f o l l o w   D o c k e r ' s   i n s t r u c t i o n s   t o   U n i n s t a l l   D o c k e r   E n g i n e .


Question: What is Uncordon the node?

Answer: k u b e c t l   u n c o r d o n   < n o d e - t o - u n c o r d o n >   R e p l a c e   < n o d e - t o - u n c o r d o n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   y o u   p r e v i o u s l y   d r a i n e d .   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Local Files And Paths Used By The Kubelet?

Answer: Local Files And Paths Used By The KubeletThe kubelet is mostly a stateless process running on a Kubernetes node. This document outlines files that kubelet reads and writes.Note:This document is for informational purpose and not describing any guaranteed behaviors or APIs. It lists resources used by the kubelet, which is an implementation detail and a subject to change at any release.The kubelet typically uses the control plane as the source of truth on what needs to run on the Node, and the container runtime to retrieve the current state of containers. So long as you provide a kubeconfig (API client configuration) to the kubelet, the kubelet does connect to your control plane; otherwise the node operates in standalone mode.On Linux nodes, the kubelet also relies on reading cgroups and various system files to collect metrics.On Windows nodes, the kubelet collects metrics via a different mechanism that does not rely on paths.There are also a few other files that are used by the kubelet as well, as kubelet communicates using local Unix-domain sockets. Some are sockets that the kubelet listens on, and for other sockets the kubelet discovers them and then connects as a client.Note:This page lists paths as Linux paths, which map to the Windows paths by adding a root disk C:\ in place of / (unless specified otherwise). For example, /var/lib/kubelet/device-plugins maps to C:\var\lib\kubelet\device-plugins.ConfigurationKubelet configuration filesThe path to the kubelet configuration file can be configured using the command line argument --config. The kubelet also supports drop-in configuration files to enhance configuration.CertificatesCertificates and private keys are typically located at /var/lib/kubelet/pki, but can be configured using the --cert-dir kubelet command line argument. Names of certificate files are also configurable.ManifestsManifests for static pods are typically located in /etc/kubernetes/manifests. Location can be configured using the staticPodPath kubelet configuration option.Systemd unit settingsWhen kubelet is running as a systemd unit, some kubelet configuration may be declared in systemd unit settings file. Typically it includes:command line arguments to run kubeletenvironment variables, used by kubelet or configuring golang runtimeStateCheckpoint files for resource managersAll resource managers keep the mapping of Pods to allocated resources in state files. State files are located in the kubelet's base directory, also termed the root directory (but not the same as /, the node root directory). You can configure the base directory for the kubelet using the kubelet command line argument --root-dir.Names of files:memory_manager_state for the Memory Managercpu_manager_state for the CPU Managerdra_manager_state for DRACheckpoint file for device managerDevice manager creates checkpoints in the same directory with socket files: /var/lib/kubelet/device-plugins/. The name of a checkpoint file is kubelet_internal_checkpoint for Device Manage


Question: How does Local Files And Paths Used By The Kubelet work?

Answer: Local Files And Paths Used By The KubeletThe kubelet is mostly a stateless process running on a Kubernetes node. This document outlines files that kubelet reads and writes.Note:This document is for informational purpose and not describing any guaranteed behaviors or APIs. It lists resources used by the kubelet, which is an implementation detail and a subject to change at any release.The kubelet typically uses the control plane as the source of truth on what needs to run on the Node, and the container runtime to retrieve the current state of containers. So long as you provide a kubeconfig (API client configuration) to the kubelet, the kubelet does connect to your control plane; otherwise the node operates in standalone mode.On Linux nodes, the kubelet also relies on reading cgroups and various system files to collect metrics.On Windows nodes, the kubelet collects metrics via a different mechanism that does not rely on paths.There are also a few other files that are used by the kubelet as well, as kubelet communicates using local Unix-domain sockets. Some are sockets that the kubelet listens on, and for other sockets the kubelet discovers them and then connects as a client.Note:This page lists paths as Linux paths, which map to the Windows paths by adding a root disk C:\ in place of / (unless specified otherwise). For example, /var/lib/kubelet/device-plugins maps to C:\var\lib\kubelet\device-plugins.ConfigurationKubelet configuration filesThe path to the kubelet configuration file can be configured using the command line argument --config. The kubelet also supports drop-in configuration files to enhance configuration.CertificatesCertificates and private keys are typically located at /var/lib/kubelet/pki, but can be configured using the --cert-dir kubelet command line argument. Names of certificate files are also configurable.ManifestsManifests for static pods are typically located in /etc/kubernetes/manifests. Location can be configured using the staticPodPath kubelet configuration option.Systemd unit settingsWhen kubelet is running as a systemd unit, some kubelet configuration may be declared in systemd unit settings file. Typically it includes:command line arguments to run kubeletenvironment variables, used by kubelet or configuring golang runtimeStateCheckpoint files for resource managersAll resource managers keep the mapping of Pods to allocated resources in state files. State files are located in the kubelet's base directory, also termed the root directory (but not the same as /, the node root directory). You can configure the base directory for the kubelet using the kubelet command line argument --root-dir.Names of files:memory_manager_state for the Memory Managercpu_manager_state for the CPU Managerdra_manager_state for DRACheckpoint file for device managerDevice manager creates checkpoints in the same directory with socket files: /var/lib/kubelet/device-plugins/. The name of a checkpoint file is kubelet_internal_checkpoint for Device Manage


Question: When would you use Local Files And Paths Used By The Kubelet?

Answer: Local Files And Paths Used By The KubeletThe kubelet is mostly a stateless process running on a Kubernetes node. This document outlines files that kubelet reads and writes.Note:This document is for informational purpose and not describing any guaranteed behaviors or APIs. It lists resources used by the kubelet, which is an implementation detail and a subject to change at any release.The kubelet typically uses the control plane as the source of truth on what needs to run on the Node, and the container runtime to retrieve the current state of containers. So long as you provide a kubeconfig (API client configuration) to the kubelet, the kubelet does connect to your control plane; otherwise the node operates in standalone mode.On Linux nodes, the kubelet also relies on reading cgroups and various system files to collect metrics.On Windows nodes, the kubelet collects metrics via a different mechanism that does not rely on paths.There are also a few other files that are used by the kubelet as well, as kubelet communicates using local Unix-domain sockets. Some are sockets that the kubelet listens on, and for other sockets the kubelet discovers them and then connects as a client.Note:This page lists paths as Linux paths, which map to the Windows paths by adding a root disk C:\ in place of / (unless specified otherwise). For example, /var/lib/kubelet/device-plugins maps to C:\var\lib\kubelet\device-plugins.ConfigurationKubelet configuration filesThe path to the kubelet configuration file can be configured using the command line argument --config. The kubelet also supports drop-in configuration files to enhance configuration.CertificatesCertificates and private keys are typically located at /var/lib/kubelet/pki, but can be configured using the --cert-dir kubelet command line argument. Names of certificate files are also configurable.ManifestsManifests for static pods are typically located in /etc/kubernetes/manifests. Location can be configured using the staticPodPath kubelet configuration option.Systemd unit settingsWhen kubelet is running as a systemd unit, some kubelet configuration may be declared in systemd unit settings file. Typically it includes:command line arguments to run kubeletenvironment variables, used by kubelet or configuring golang runtimeStateCheckpoint files for resource managersAll resource managers keep the mapping of Pods to allocated resources in state files. State files are located in the kubelet's base directory, also termed the root directory (but not the same as /, the node root directory). You can configure the base directory for the kubelet using the kubelet command line argument --root-dir.Names of files:memory_manager_state for the Memory Managercpu_manager_state for the CPU Managerdra_manager_state for DRACheckpoint file for device managerDevice manager creates checkpoints in the same directory with socket files: /var/lib/kubelet/device-plugins/. The name of a checkpoint file is kubelet_internal_checkpoint for Device Manage


Question: What are the benefits of Local Files And Paths Used By The Kubelet?

Answer: Local Files And Paths Used By The KubeletThe kubelet is mostly a stateless process running on a Kubernetes node. This document outlines files that kubelet reads and writes.Note:This document is for informational purpose and not describing any guaranteed behaviors or APIs. It lists resources used by the kubelet, which is an implementation detail and a subject to change at any release.The kubelet typically uses the control plane as the source of truth on what needs to run on the Node, and the container runtime to retrieve the current state of containers. So long as you provide a kubeconfig (API client configuration) to the kubelet, the kubelet does connect to your control plane; otherwise the node operates in standalone mode.On Linux nodes, the kubelet also relies on reading cgroups and various system files to collect metrics.On Windows nodes, the kubelet collects metrics via a different mechanism that does not rely on paths.There are also a few other files that are used by the kubelet as well, as kubelet communicates using local Unix-domain sockets. Some are sockets that the kubelet listens on, and for other sockets the kubelet discovers them and then connects as a client.Note:This page lists paths as Linux paths, which map to the Windows paths by adding a root disk C:\ in place of / (unless specified otherwise). For example, /var/lib/kubelet/device-plugins maps to C:\var\lib\kubelet\device-plugins.ConfigurationKubelet configuration filesThe path to the kubelet configuration file can be configured using the command line argument --config. The kubelet also supports drop-in configuration files to enhance configuration.CertificatesCertificates and private keys are typically located at /var/lib/kubelet/pki, but can be configured using the --cert-dir kubelet command line argument. Names of certificate files are also configurable.ManifestsManifests for static pods are typically located in /etc/kubernetes/manifests. Location can be configured using the staticPodPath kubelet configuration option.Systemd unit settingsWhen kubelet is running as a systemd unit, some kubelet configuration may be declared in systemd unit settings file. Typically it includes:command line arguments to run kubeletenvironment variables, used by kubelet or configuring golang runtimeStateCheckpoint files for resource managersAll resource managers keep the mapping of Pods to allocated resources in state files. State files are located in the kubelet's base directory, also termed the root directory (but not the same as /, the node root directory). You can configure the base directory for the kubelet using the kubelet command line argument --root-dir.Names of files:memory_manager_state for the Memory Managercpu_manager_state for the CPU Managerdra_manager_state for DRACheckpoint file for device managerDevice manager creates checkpoints in the same directory with socket files: /var/lib/kubelet/device-plugins/. The name of a checkpoint file is kubelet_internal_checkpoint for Device Manage


Question: What is Local Files And Paths Used By The Kubelet?

Answer: T h e   k u b e l e t   i s   m o s t l y   a   s t a t e l e s s   p r o c e s s   r u n n i n g   o n   a   K u b e r n e t e s   n o d e .   T h i s   d o c u m e n t   o u t l i n e s   f i l e s   t h a t   k u b e l e t   r e a d s   a n d   w r i t e s .


Question: What is Note:?

Answer: T h e   k u b e l e t   t y p i c a l l y   u s e s   t h e   c o n t r o l   p l a n e   a s   t h e   s o u r c e   o f   t r u t h   o n   w h a t   n e e d s   t o   r u n   o n   t h e   N o d e ,   a n d   t h e   c o n t a i n e r   r u n t i m e   t o   r e t r i e v e   t h e   c u r r e n t   s t a t e   o f   c o n t a i n e r s .   S o   l o n g   a s   y o u   p r o v i d e   a   k u b e c o n f i g   ( A P I   c l i e n t   c o n f i g u r a t i o n )   t o   t h e   k u b e l e t ,   t h e   k u b e l e t   d o e s   c o n n e c t   t o   y o u r   c o n t r o l   p l a n e ;   o t h e r w i s e   t h e   n o d e   o p e r a t e s   i n   s t a n d a l o n e   m o d e .   O n   L i n u x   n o d e s ,   t h e   k u b e l e t   a l s o   r e l i e s   o n   r e a d i n g   c g r o u p s   a n d   v a r i o u s   s y s t e m   f i l e s   t o   c o l l e c t   m e t r i c s .   O n   W i n d o w s   n o d e s ,   t h e   k u b e l e t   c o l l e c t s   m e t r i c s   v i a   a   d i f f e r e n t   m e c h a n i s m   t h a t   d o e s   n o t   r e l y   o n   p a t h s .   T h e r e   a r e   a l s o   a   f e w   o t h e r   f i l e s   t h a t   a r e   u s e d   b y   t h e   k u b e l e t   a s   w e l l ,   a s   k u b e l e t   c o m m u n i c a t e s   u s i n g   l o c a l   U n i x - d o m a i n   s o c k e t s .   S o m e   a r e   s o c k e t s   t h a t   t h e   k u b e l e t   l i s t e n s   o n ,   a n d   f o r   o t h e r   s o c k e t s   t h e   k u b e l e t   d i s c o v e r s   t h e m   a n d   t h e n   c o n n e c t s   a s   a   c l i e n t .


Question: What is Kubelet configuration files?

Answer: T h e   p a t h   t o   t h e   k u b e l e t   c o n f i g u r a t i o n   f i l e   c a n   b e   c o n f i g u r e d   u s i n g   t h e   c o m m a n d   l i n e   a r g u m e n t   - - c o n f i g .   T h e   k u b e l e t   a l s o   s u p p o r t s   d r o p - i n   c o n f i g u r a t i o n   f i l e s   t o   e n h a n c e   c o n f i g u r a t i o n .


Question: What is Certificates?

Answer: C e r t i f i c a t e s   a n d   p r i v a t e   k e y s   a r e   t y p i c a l l y   l o c a t e d   a t   / v a r / l i b / k u b e l e t / p k i ,   b u t   c a n   b e   c o n f i g u r e d   u s i n g   t h e   - - c e r t - d i r   k u b e l e t   c o m m a n d   l i n e   a r g u m e n t .   N a m e s   o f   c e r t i f i c a t e   f i l e s   a r e   a l s o   c o n f i g u r a b l e .


Question: What is Manifests?

Answer: M a n i f e s t s   f o r   s t a t i c   p o d s   a r e   t y p i c a l l y   l o c a t e d   i n   / e t c / k u b e r n e t e s / m a n i f e s t s .   L o c a t i o n   c a n   b e   c o n f i g u r e d   u s i n g   t h e   s t a t i c P o d P a t h   k u b e l e t   c o n f i g u r a t i o n   o p t i o n .


Question: What is Systemd unit settings?

Answer: W h e n   k u b e l e t   i s   r u n n i n g   a s   a   s y s t e m d   u n i t ,   s o m e   k u b e l e t   c o n f i g u r a t i o n   m a y   b e   d e c l a r e d   i n   s y s t e m d   u n i t   s e t t i n g s   f i l e .   T y p i c a l l y   i t   i n c l u d e s :   c o m m a n d   l i n e   a r g u m e n t s   t o   r u n   k u b e l e t e n v i r o n m e n t   v a r i a b l e s ,   u s e d   b y   k u b e l e t   o r   c o n f i g u r i n g   g o l a n g   r u n t i m e


Question: What is Checkpoint files for resource managers?

Answer: A l l   r e s o u r c e   m a n a g e r s   k e e p   t h e   m a p p i n g   o f   P o d s   t o   a l l o c a t e d   r e s o u r c e s   i n   s t a t e   f i l e s .   S t a t e   f i l e s   a r e   l o c a t e d   i n   t h e   k u b e l e t ' s   b a s e   d i r e c t o r y ,   a l s o   t e r m e d   t h e   r o o t   d i r e c t o r y   ( b u t   n o t   t h e   s a m e   a s   / ,   t h e   n o d e   r o o t   d i r e c t o r y ) .   Y o u   c a n   c o n f i g u r e   t h e   b a s e   d i r e c t o r y   f o r   t h e   k u b e l e t   u s i n g   t h e   k u b e l e t   c o m m a n d   l i n e   a r g u m e n t   - - r o o t - d i r .   N a m e s   o f   f i l e s :   m e m o r y _ m a n a g e r _ s t a t e   f o r   t h e   M e m o r y   M a n a g e r c p u _ m a n a g e r _ s t a t e   f o r   t h e   C P U   M a n a g e r d r a _ m a n a g e r _ s t a t e   f o r   D R A


Question: What is Checkpoint file for device manager?

Answer: D e v i c e   m a n a g e r   c r e a t e s   c h e c k p o i n t s   i n   t h e   s a m e   d i r e c t o r y   w i t h   s o c k e t   f i l e s :   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s / .   T h e   n a m e   o f   a   c h e c k p o i n t   f i l e   i s   k u b e l e t _ i n t e r n a l _ c h e c k p o i n t   f o r   D e v i c e   M a n a g e r


Question: What is Pod resource checkpoints?

Answer: I f   a   n o d e   h a s   e n a b l e d   t h e   I n P l a c e P o d V e r t i c a l S c a l i n g f e a t u r e   g a t e ,   t h e   k u b e l e t   s t o r e s   a   l o c a l   r e c o r d   o f   a l l o c a t e d   a n d   a c t u a t e d   P o d   r e s o u r c e s .   S e e   R e s i z e   C P U   a n d   M e m o r y   R e s o u r c e s   a s s i g n e d   t o   C o n t a i n e r s   f o r   m o r e   d e t a i l s   o n   h o w   t h e s e   r e c o r d s   a r e   u s e d .   N a m e s   o f   f i l e s :   a l l o c a t e d _ p o d s _ s t a t e   r e c o r d s   t h e   r e s o u r c e s   a l l o c a t e d   t o   e a c h   p o d   r u n n i n g   o n   t h e   n o d e a c t u a t e d _ p o d s _ s t a t e   r e c o r d s   t h e   r e s o u r c e s   t h a t   h a v e   b e e n   a c c e p t e d   b y   t h e   r u n t i m e   f o r   e a c h   p o d   p o d   r u n n i n g   o n   t h e   n o d e   T h e   f i l e s   a r e   l o c a t e d   w i t h i n   t h e   k u b e l e t   b a s e   d i r e c t o r y   ( / v a r / l i b / k u b e l e t   b y   d e f a u l t   o n   L i n u x ;   c o n f i g u r a b l e   u s i n g   - - r o o t - d i r ) .


Question: What is Container runtime?

Answer: K u b e l e t   c o m m u n i c a t e s   w i t h   t h e   c o n t a i n e r   r u n t i m e   u s i n g   s o c k e t   c o n f i g u r e d   v i a   t h e   c o n f i g u r a t i o n   p a r a m e t e r s :   c o n t a i n e r R u n t i m e E n d p o i n t   f o r   r u n t i m e   o p e r a t i o n s i m a g e S e r v i c e E n d p o i n t   f o r   i m a g e   m a n a g e m e n t   o p e r a t i o n s   T h e   a c t u a l   v a l u e s   o f   t h o s e   e n d p o i n t s   d e p e n d   o n   t h e   c o n t a i n e r   r u n t i m e   b e i n g   u s e d .


Question: What is Device plugins?

Answer: T h e   k u b e l e t   e x p o s e s   a   s o c k e t   a t   t h e   p a t h   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s / k u b e l e t . s o c k   f o r   v a r i o u s   D e v i c e   P l u g i n s   t o   r e g i s t e r .   W h e n   a   d e v i c e   p l u g i n   r e g i s t e r s   i t s e l f ,   i t   p r o v i d e s   i t s   s o c k e t   p a t h   f o r   t h e   k u b e l e t   t o   c o n n e c t .   T h e   d e v i c e   p l u g i n   s o c k e t   s h o u l d   b e   i n   t h e   d i r e c t o r y   d e v i c e - p l u g i n s   w i t h i n   t h e   k u b e l e t   b a s e   d i r e c t o r y .   O n   a   t y p i c a l   L i n u x   n o d e ,   t h i s   m e a n s   / v a r / l i b / k u b e l e t / d e v i c e - p l u g i n s .


Question: What is Pod resources API?

Answer: P o d   R e s o u r c e s   A P I   w i l l   b e   e x p o s e d   a t   t h e   p a t h   / v a r / l i b / k u b e l e t / p o d - r e s o u r c e s .


Question: What is DRA, CSI, and Device plugins?

Answer: T h e   k u b e l e t   l o o k s   f o r   s o c k e t   f i l e s   c r e a t e d   b y   d e v i c e   p l u g i n s   m a n a g e d   v i a   D R A ,   d e v i c e   m a n a g e r ,   o r   s t o r a g e   p l u g i n s ,   a n d   t h e n   a t t e m p t s   t o   c o n n e c t   t o   t h e s e   s o c k e t s .   T h e   d i r e c t o r y   t h a t   t h e   k u b e l e t   l o o k s   i n   i s   p l u g i n s _ r e g i s t r y   w i t h i n   t h e   k u b e l e t   b a s e   d i r e c t o r y ,   s o   o n   a   t y p i c a l   L i n u x   n o d e   t h i s   m e a n s   / v a r / l i b / k u b e l e t / p l u g i n s _ r e g i s t r y .   N o t e ,   f o r   t h e   d e v i c e   p l u g i n s   t h e r e   a r e   t w o   a l t e r n a t i v e   r e g i s t r a t i o n   m e c h a n i s m s   O n l y   o n e   s h o u l d   b e   u s e d   f o r   a   g i v e n   p l u g i n .   T h e   t y p e s   o f   p l u g i n s   t h a t   c a n   p l a c e   s o c k e t   f i l e s   i n t o   t h a t   d i r e c t o r y   a r e :   C S I   p l u g i n s D R A   p l u g i n s D e v i c e   M a n a g e r   p l u g i n s   ( t y p i c a l l y   / v a r / l i b / k u b e l e t / p l u g i n s _ r e g i s t r y ) .


Question: What is Graceful node shutdown?

Answer: G r a c e f u l   n o d e   s h u t d o w n   s t o r e s   s t a t e   l o c a l l y   a t   / v a r / l i b / k u b e l e t / g r a c e f u l _ n o d e _ s h u t d o w n _ s t a t e .


Question: What is Image Pull Records?

Answer: T h e   k u b e l e t   s t o r e s   r e c o r d s   o f   a t t e m p t e d   a n d   s u c c e s s f u l   i m a g e   p u l l s ,   a n d   u s e s   i t   t o   v e r i f y   t h a t   t h e   i m a g e   w a s   p r e v i o u s l y   s u c c e s s f u l l y   p u l l e d   w i t h   t h e   s a m e   c r e d e n t i a l s .   T h e s e   r e c o r d s   a r e   c a c h e d   a s   f i l e s   i n   t h e   i m a g e _ r e g i s t r y   d i r e c t o r y   w i t h i n   t h e   k u b e l e t   b a s e   d i r e c t o r y .   O n   a   t y p i c a l   L i n u x   n o d e ,   t h i s   m e a n s   / v a r / l i b / k u b e l e t / i m a g e _ m a n a g e r .   T h e r e   a r e   t w o   s u b d i r e c t o r i e s   t o   i m a g e _ m a n a g e r :   p u l l i n g   -   s t o r e s   r e c o r d s   a b o u t   i m a g e s   t h e   K u b e l e t   i s   a t t e m p t i n g   t o   p u l l . p u l l e d   -   s t o r e s   r e c o r d s   a b o u t   i m a g e s   t h a t   w e r e   s u c c e s s f u l l y   p u l l e d   b y   t h e   K u b e l e t ,   a l o n g   w i t h   m e t a d a t a   a b o u t   t h e   c r e d e n t i a l s   u s e d   f o r   t h e   p u l l s .   S e e   E n s u r e   I m a g e   P u l l   C r e d e n t i a l   V e r i f i c a t i o n   f o r   d e t a i l s .


Question: What is Seccomp?

Answer: S e c c o m p   p r o f i l e   f i l e s   r e f e r e n c e d   f r o m   P o d s   s h o u l d   b e   p l a c e d   i n   / v a r / l i b / k u b e l e t / s e c c o m p .   S e e   t h e   s e c c o m p   r e f e r e n c e   f o r   d e t a i l s .


Question: What is AppArmor?

Answer: T h e   k u b e l e t   d o e s   n o t   l o a d   o r   r e f e r   t o   A p p A r m o r   p r o f i l e s   b y   a   K u b e r n e t e s - s p e c i f i c   p a t h .   A p p A r m o r   p r o f i l e s   a r e   l o a d e d   v i a   t h e   n o d e   o p e r a t i n g   s y s t e m   r a t h e r   t h e n   r e f e r e n c e d   b y   t h e i r   p a t h .


Question: What is Locking?

Answer: A   l o c k   f i l e   f o r   t h e   k u b e l e t ;   t y p i c a l l y   / v a r / r u n / k u b e l e t . l o c k .   T h e   k u b e l e t   u s e s   t h i s   t o   e n s u r e   t h a t   t w o   d i f f e r e n t   k u b e l e t s   d o n ' t   t r y   t o   r u n   i n   c o n f l i c t   w i t h   e a c h   o t h e r .   Y o u   c a n   c o n f i g u r e   t h e   p a t h   t o   t h e   l o c k   f i l e   u s i n g   t h e   t h e   - - l o c k - f i l e   k u b e l e t   c o m m a n d   l i n e   a r g u m e n t .   I f   t w o   k u b e l e t s   o n   t h e   s a m e   n o d e   u s e   a   d i f f e r e n t   v a l u e   f o r   t h e   l o c k   f i l e   p a t h ,   t h e y   w i l l   n o t   b e   a b l e   t o   d e t e c t   a   c o n f l i c t   w h e n   b o t h   a r e   r u n n i n g .


Question: What is What's next?

Answer: L e a r n   a b o u t   t h e   k u b e l e t   c o m m a n d   l i n e   a r g u m e n t s . R e v i e w   t h e   K u b e l e t   C o n f i g u r a t i o n   ( v 1 b e t a 1 )   r e f e r e n c e


Question: What is Introduction to kubectl?

Answer: Introduction to kubectlkubectl is the Kubernetes cli version of a swiss army knife, and can do many things.While this Book is focused on using kubectl to declaratively manage applications in Kubernetes, it also covers other kubectl functions.Command FamiliesMost kubectl commands typically fall into one of a few categories:TypeUsed ForDescriptionDeclarative Resource ManagementDeployment and operations (e.g. GitOps)Declaratively manage Kubernetes workloads using resource configurationImperative Resource ManagementDevelopment OnlyRun commands to manage Kubernetes workloads using Command Line arguments and flagsPrinting Workload StateDebuggingPrint information about workloadsInteracting with ContainersDebuggingExec, attach, cp, logsCluster ManagementCluster operationsDrain and cordon NodesDeclarative Application ManagementThe preferred approach for managing resources is through declarative files called resource configuration used with the kubectl Apply command. This command reads a local (or remote) file structure and modifies cluster state to reflect the declared intent.ApplyApply is the preferred mechanism for managing resources in a Kubernetes cluster.Printing State about WorkloadsUsers will need to view workload state.Printing summarize state and information about resourcesPrinting complete state and information about resourcesPrinting specific fields from resourcesQuery resources matching labelsDebugging Workloadskubectl supports debugging by providing commands for:Printing Container logsPrinting cluster eventsExec or attaching to a ContainerCopying files from Containers in the cluster to a user's filesystemCluster ManagementOn occasion, users may need to perform operations to the Nodes of cluster. kubectl supports commands to drain workloads from a Node so that it can be decommissioned or debugged.PorcelainUsers may find using resource configuration overly verbose for development and prefer to work with the cluster imperatively with a shell-like workflow. kubectl offers porcelain commands for generating and modifying resources.Generating + creating resources such as Deployments, StatefulSets, Services, ConfigMaps, etc.Setting fields on resourcesEditing (live) resources in a text editorPorcelain for Dev OnlyPorcelain commands are time saving for experimenting with workloads in a dev cluster, but shouldn't be used for production.


Question: How does Introduction to kubectl work?

Answer: Introduction to kubectlkubectl is the Kubernetes cli version of a swiss army knife, and can do many things.While this Book is focused on using kubectl to declaratively manage applications in Kubernetes, it also covers other kubectl functions.Command FamiliesMost kubectl commands typically fall into one of a few categories:TypeUsed ForDescriptionDeclarative Resource ManagementDeployment and operations (e.g. GitOps)Declaratively manage Kubernetes workloads using resource configurationImperative Resource ManagementDevelopment OnlyRun commands to manage Kubernetes workloads using Command Line arguments and flagsPrinting Workload StateDebuggingPrint information about workloadsInteracting with ContainersDebuggingExec, attach, cp, logsCluster ManagementCluster operationsDrain and cordon NodesDeclarative Application ManagementThe preferred approach for managing resources is through declarative files called resource configuration used with the kubectl Apply command. This command reads a local (or remote) file structure and modifies cluster state to reflect the declared intent.ApplyApply is the preferred mechanism for managing resources in a Kubernetes cluster.Printing State about WorkloadsUsers will need to view workload state.Printing summarize state and information about resourcesPrinting complete state and information about resourcesPrinting specific fields from resourcesQuery resources matching labelsDebugging Workloadskubectl supports debugging by providing commands for:Printing Container logsPrinting cluster eventsExec or attaching to a ContainerCopying files from Containers in the cluster to a user's filesystemCluster ManagementOn occasion, users may need to perform operations to the Nodes of cluster. kubectl supports commands to drain workloads from a Node so that it can be decommissioned or debugged.PorcelainUsers may find using resource configuration overly verbose for development and prefer to work with the cluster imperatively with a shell-like workflow. kubectl offers porcelain commands for generating and modifying resources.Generating + creating resources such as Deployments, StatefulSets, Services, ConfigMaps, etc.Setting fields on resourcesEditing (live) resources in a text editorPorcelain for Dev OnlyPorcelain commands are time saving for experimenting with workloads in a dev cluster, but shouldn't be used for production.


Question: When would you use Introduction to kubectl?

Answer: Introduction to kubectlkubectl is the Kubernetes cli version of a swiss army knife, and can do many things.While this Book is focused on using kubectl to declaratively manage applications in Kubernetes, it also covers other kubectl functions.Command FamiliesMost kubectl commands typically fall into one of a few categories:TypeUsed ForDescriptionDeclarative Resource ManagementDeployment and operations (e.g. GitOps)Declaratively manage Kubernetes workloads using resource configurationImperative Resource ManagementDevelopment OnlyRun commands to manage Kubernetes workloads using Command Line arguments and flagsPrinting Workload StateDebuggingPrint information about workloadsInteracting with ContainersDebuggingExec, attach, cp, logsCluster ManagementCluster operationsDrain and cordon NodesDeclarative Application ManagementThe preferred approach for managing resources is through declarative files called resource configuration used with the kubectl Apply command. This command reads a local (or remote) file structure and modifies cluster state to reflect the declared intent.ApplyApply is the preferred mechanism for managing resources in a Kubernetes cluster.Printing State about WorkloadsUsers will need to view workload state.Printing summarize state and information about resourcesPrinting complete state and information about resourcesPrinting specific fields from resourcesQuery resources matching labelsDebugging Workloadskubectl supports debugging by providing commands for:Printing Container logsPrinting cluster eventsExec or attaching to a ContainerCopying files from Containers in the cluster to a user's filesystemCluster ManagementOn occasion, users may need to perform operations to the Nodes of cluster. kubectl supports commands to drain workloads from a Node so that it can be decommissioned or debugged.PorcelainUsers may find using resource configuration overly verbose for development and prefer to work with the cluster imperatively with a shell-like workflow. kubectl offers porcelain commands for generating and modifying resources.Generating + creating resources such as Deployments, StatefulSets, Services, ConfigMaps, etc.Setting fields on resourcesEditing (live) resources in a text editorPorcelain for Dev OnlyPorcelain commands are time saving for experimenting with workloads in a dev cluster, but shouldn't be used for production.


Question: What are the benefits of Introduction to kubectl?

Answer: Introduction to kubectlkubectl is the Kubernetes cli version of a swiss army knife, and can do many things.While this Book is focused on using kubectl to declaratively manage applications in Kubernetes, it also covers other kubectl functions.Command FamiliesMost kubectl commands typically fall into one of a few categories:TypeUsed ForDescriptionDeclarative Resource ManagementDeployment and operations (e.g. GitOps)Declaratively manage Kubernetes workloads using resource configurationImperative Resource ManagementDevelopment OnlyRun commands to manage Kubernetes workloads using Command Line arguments and flagsPrinting Workload StateDebuggingPrint information about workloadsInteracting with ContainersDebuggingExec, attach, cp, logsCluster ManagementCluster operationsDrain and cordon NodesDeclarative Application ManagementThe preferred approach for managing resources is through declarative files called resource configuration used with the kubectl Apply command. This command reads a local (or remote) file structure and modifies cluster state to reflect the declared intent.ApplyApply is the preferred mechanism for managing resources in a Kubernetes cluster.Printing State about WorkloadsUsers will need to view workload state.Printing summarize state and information about resourcesPrinting complete state and information about resourcesPrinting specific fields from resourcesQuery resources matching labelsDebugging Workloadskubectl supports debugging by providing commands for:Printing Container logsPrinting cluster eventsExec or attaching to a ContainerCopying files from Containers in the cluster to a user's filesystemCluster ManagementOn occasion, users may need to perform operations to the Nodes of cluster. kubectl supports commands to drain workloads from a Node so that it can be decommissioned or debugged.PorcelainUsers may find using resource configuration overly verbose for development and prefer to work with the cluster imperatively with a shell-like workflow. kubectl offers porcelain commands for generating and modifying resources.Generating + creating resources such as Deployments, StatefulSets, Services, ConfigMaps, etc.Setting fields on resourcesEditing (live) resources in a text editorPorcelain for Dev OnlyPorcelain commands are time saving for experimenting with workloads in a dev cluster, but shouldn't be used for production.


Question: What is Introduction to kubectl?

Answer: k u b e c t l   i s   t h e   K u b e r n e t e s   c l i   v e r s i o n   o f   a   s w i s s   a r m y   k n i f e ,   a n d   c a n   d o   m a n y   t h i n g s .   W h i l e   t h i s   B o o k   i s   f o c u s e d   o n   u s i n g   k u b e c t l   t o   d e c l a r a t i v e l y   m a n a g e   a p p l i c a t i o n s   i n   K u b e r n e t e s ,   i t   a l s o   c o v e r s   o t h e r   k u b e c t l   f u n c t i o n s .


Question: What is Command Families?

Answer: M o s t   k u b e c t l   c o m m a n d s   t y p i c a l l y   f a l l   i n t o   o n e   o f   a   f e w   c a t e g o r i e s :


Question: What is Declarative Application Management?

Answer: T h e   p r e f e r r e d   a p p r o a c h   f o r   m a n a g i n g   r e s o u r c e s   i s   t h r o u g h   d e c l a r a t i v e   f i l e s   c a l l e d   r e s o u r c e   c o n f i g u r a t i o n   u s e d   w i t h   t h e   k u b e c t l   A p p l y   c o m m a n d .   T h i s   c o m m a n d   r e a d s   a   l o c a l   ( o r   r e m o t e )   f i l e   s t r u c t u r e   a n d   m o d i f i e s   c l u s t e r   s t a t e   t o   r e f l e c t   t h e   d e c l a r e d   i n t e n t .


Question: What is Printing State about Workloads?

Answer: U s e r s   w i l l   n e e d   t o   v i e w   w o r k l o a d   s t a t e .   P r i n t i n g   s u m m a r i z e   s t a t e   a n d   i n f o r m a t i o n   a b o u t   r e s o u r c e s P r i n t i n g   c o m p l e t e   s t a t e   a n d   i n f o r m a t i o n   a b o u t   r e s o u r c e s P r i n t i n g   s p e c i f i c   f i e l d s   f r o m   r e s o u r c e s Q u e r y   r e s o u r c e s   m a t c h i n g   l a b e l s


Question: What is Debugging Workloads?

Answer: k u b e c t l   s u p p o r t s   d e b u g g i n g   b y   p r o v i d i n g   c o m m a n d s   f o r :   P r i n t i n g   C o n t a i n e r   l o g s P r i n t i n g   c l u s t e r   e v e n t s E x e c   o r   a t t a c h i n g   t o   a   C o n t a i n e r C o p y i n g   f i l e s   f r o m   C o n t a i n e r s   i n   t h e   c l u s t e r   t o   a   u s e r ' s   f i l e s y s t e m


Question: What is Cluster Management?

Answer: O n   o c c a s i o n ,   u s e r s   m a y   n e e d   t o   p e r f o r m   o p e r a t i o n s   t o   t h e   N o d e s   o f   c l u s t e r .   k u b e c t l   s u p p o r t s   c o m m a n d s   t o   d r a i n   w o r k l o a d s   f r o m   a   N o d e   s o   t h a t   i t   c a n   b e   d e c o m m i s s i o n e d   o r   d e b u g g e d .


Question: What is Porcelain?

Answer: U s e r s   m a y   f i n d   u s i n g   r e s o u r c e   c o n f i g u r a t i o n   o v e r l y   v e r b o s e   f o r   d e v e l o p m e n t   a n d   p r e f e r   t o   w o r k   w i t h   t h e   c l u s t e r   i m p e r a t i v e l y   w i t h   a   s h e l l - l i k e   w o r k f l o w .   k u b e c t l   o f f e r s   p o r c e l a i n   c o m m a n d s   f o r   g e n e r a t i n g   a n d   m o d i f y i n g   r e s o u r c e s .   G e n e r a t i n g   +   c r e a t i n g   r e s o u r c e s   s u c h   a s   D e p l o y m e n t s ,   S t a t e f u l S e t s ,   S e r v i c e s ,   C o n f i g M a p s ,   e t c . S e t t i n g   f i e l d s   o n   r e s o u r c e s E d i t i n g   ( l i v e )   r e s o u r c e s   i n   a   t e x t   e d i t o r


Question: What is Using a KMS provider for data encryption?

Answer: Using a KMS provider for data encryptionThis page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption. In Kubernetes 1.34 there are two versions of KMS at-rest encryption. You should use KMS v2 if feasible because KMS v1 is deprecated (since Kubernetes v1.28) and disabled by default (since Kubernetes v1.29). KMS v2 offers significantly better performance characteristics than KMS v1.Caution:This documentation is for the generally available implementation of KMS v2 (and for the deprecated version 1 implementation). If you are using any control plane components older than Kubernetes v1.29, please check the equivalent page in the documentation for the version of Kubernetes that your cluster is running. Earlier releases of Kubernetes had different behavior that may be relevant for information security.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe version of Kubernetes that you need depends on which KMS API version you have selected. Kubernetes recommends using KMS v2.If you selected KMS API v1 to support clusters prior to version v1.27 or if you have a legacy KMS plugin that only supports KMS v1, any supported Kubernetes version will work. This API is deprecated as of Kubernetes v1.28. Kubernetes does not recommend the use of this API.To check the version, enter kubectl version.KMS v1FEATURE STATE: Kubernetes v1.28 [deprecated]Kubernetes version 1.10.0 or later is requiredFor version 1.29 and later, the v1 implementation of KMS is disabled by default. To enable the feature, set --feature-gates=KMSv1=true to configure a KMS v1 provider.Your cluster must use etcd v3 or laterKMS v2FEATURE STATE: Kubernetes v1.29 [stable]Your cluster must use etcd v3 or laterKMS encryption and per-object encryption keysThe KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK). The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS.If you use the (deprecated) v1 implementation of KMS, a new DEK is generated for each encryption.With KMS v2, a new DEK is generated per encryption: the API server uses a key derivation function to generate single use data encryption keys from a secret seed combined with some random data. The seed is rotated whenever the KEK is rotated (see the Understanding key_id and Key Rotation section below for more details).The KMS provider uses gRPC to communicate with a specific KMS plugin over a UNIX domain socket. The KMS plugin, which is implemented as a gRPC server and deployed on


Question: How does Using a KMS provider for data encryption work?

Answer: Using a KMS provider for data encryptionThis page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption. In Kubernetes 1.34 there are two versions of KMS at-rest encryption. You should use KMS v2 if feasible because KMS v1 is deprecated (since Kubernetes v1.28) and disabled by default (since Kubernetes v1.29). KMS v2 offers significantly better performance characteristics than KMS v1.Caution:This documentation is for the generally available implementation of KMS v2 (and for the deprecated version 1 implementation). If you are using any control plane components older than Kubernetes v1.29, please check the equivalent page in the documentation for the version of Kubernetes that your cluster is running. Earlier releases of Kubernetes had different behavior that may be relevant for information security.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe version of Kubernetes that you need depends on which KMS API version you have selected. Kubernetes recommends using KMS v2.If you selected KMS API v1 to support clusters prior to version v1.27 or if you have a legacy KMS plugin that only supports KMS v1, any supported Kubernetes version will work. This API is deprecated as of Kubernetes v1.28. Kubernetes does not recommend the use of this API.To check the version, enter kubectl version.KMS v1FEATURE STATE: Kubernetes v1.28 [deprecated]Kubernetes version 1.10.0 or later is requiredFor version 1.29 and later, the v1 implementation of KMS is disabled by default. To enable the feature, set --feature-gates=KMSv1=true to configure a KMS v1 provider.Your cluster must use etcd v3 or laterKMS v2FEATURE STATE: Kubernetes v1.29 [stable]Your cluster must use etcd v3 or laterKMS encryption and per-object encryption keysThe KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK). The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS.If you use the (deprecated) v1 implementation of KMS, a new DEK is generated for each encryption.With KMS v2, a new DEK is generated per encryption: the API server uses a key derivation function to generate single use data encryption keys from a secret seed combined with some random data. The seed is rotated whenever the KEK is rotated (see the Understanding key_id and Key Rotation section below for more details).The KMS provider uses gRPC to communicate with a specific KMS plugin over a UNIX domain socket. The KMS plugin, which is implemented as a gRPC server and deployed on


Question: When would you use Using a KMS provider for data encryption?

Answer: Using a KMS provider for data encryptionThis page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption. In Kubernetes 1.34 there are two versions of KMS at-rest encryption. You should use KMS v2 if feasible because KMS v1 is deprecated (since Kubernetes v1.28) and disabled by default (since Kubernetes v1.29). KMS v2 offers significantly better performance characteristics than KMS v1.Caution:This documentation is for the generally available implementation of KMS v2 (and for the deprecated version 1 implementation). If you are using any control plane components older than Kubernetes v1.29, please check the equivalent page in the documentation for the version of Kubernetes that your cluster is running. Earlier releases of Kubernetes had different behavior that may be relevant for information security.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe version of Kubernetes that you need depends on which KMS API version you have selected. Kubernetes recommends using KMS v2.If you selected KMS API v1 to support clusters prior to version v1.27 or if you have a legacy KMS plugin that only supports KMS v1, any supported Kubernetes version will work. This API is deprecated as of Kubernetes v1.28. Kubernetes does not recommend the use of this API.To check the version, enter kubectl version.KMS v1FEATURE STATE: Kubernetes v1.28 [deprecated]Kubernetes version 1.10.0 or later is requiredFor version 1.29 and later, the v1 implementation of KMS is disabled by default. To enable the feature, set --feature-gates=KMSv1=true to configure a KMS v1 provider.Your cluster must use etcd v3 or laterKMS v2FEATURE STATE: Kubernetes v1.29 [stable]Your cluster must use etcd v3 or laterKMS encryption and per-object encryption keysThe KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK). The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS.If you use the (deprecated) v1 implementation of KMS, a new DEK is generated for each encryption.With KMS v2, a new DEK is generated per encryption: the API server uses a key derivation function to generate single use data encryption keys from a secret seed combined with some random data. The seed is rotated whenever the KEK is rotated (see the Understanding key_id and Key Rotation section below for more details).The KMS provider uses gRPC to communicate with a specific KMS plugin over a UNIX domain socket. The KMS plugin, which is implemented as a gRPC server and deployed on


Question: What are the benefits of Using a KMS provider for data encryption?

Answer: Using a KMS provider for data encryptionThis page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption. In Kubernetes 1.34 there are two versions of KMS at-rest encryption. You should use KMS v2 if feasible because KMS v1 is deprecated (since Kubernetes v1.28) and disabled by default (since Kubernetes v1.29). KMS v2 offers significantly better performance characteristics than KMS v1.Caution:This documentation is for the generally available implementation of KMS v2 (and for the deprecated version 1 implementation). If you are using any control plane components older than Kubernetes v1.29, please check the equivalent page in the documentation for the version of Kubernetes that your cluster is running. Earlier releases of Kubernetes had different behavior that may be relevant for information security.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe version of Kubernetes that you need depends on which KMS API version you have selected. Kubernetes recommends using KMS v2.If you selected KMS API v1 to support clusters prior to version v1.27 or if you have a legacy KMS plugin that only supports KMS v1, any supported Kubernetes version will work. This API is deprecated as of Kubernetes v1.28. Kubernetes does not recommend the use of this API.To check the version, enter kubectl version.KMS v1FEATURE STATE: Kubernetes v1.28 [deprecated]Kubernetes version 1.10.0 or later is requiredFor version 1.29 and later, the v1 implementation of KMS is disabled by default. To enable the feature, set --feature-gates=KMSv1=true to configure a KMS v1 provider.Your cluster must use etcd v3 or laterKMS v2FEATURE STATE: Kubernetes v1.29 [stable]Your cluster must use etcd v3 or laterKMS encryption and per-object encryption keysThe KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK). The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS.If you use the (deprecated) v1 implementation of KMS, a new DEK is generated for each encryption.With KMS v2, a new DEK is generated per encryption: the API server uses a key derivation function to generate single use data encryption keys from a secret seed combined with some random data. The seed is rotated whenever the KEK is rotated (see the Understanding key_id and Key Rotation section below for more details).The KMS provider uses gRPC to communicate with a specific KMS plugin over a UNIX domain socket. The KMS plugin, which is implemented as a gRPC server and deployed on


Question: What is Using a KMS provider for data encryption?

Answer: T h i s   p a g e   s h o w s   h o w   t o   c o n f i g u r e   a   K e y   M a n a g e m e n t   S e r v i c e   ( K M S )   p r o v i d e r   a n d   p l u g i n   t o   e n a b l e   s e c r e t   d a t a   e n c r y p t i o n .   I n   K u b e r n e t e s   1 . 3 4   t h e r e   a r e   t w o   v e r s i o n s   o f   K M S   a t - r e s t   e n c r y p t i o n .   Y o u   s h o u l d   u s e   K M S   v 2   i f   f e a s i b l e   b e c a u s e   K M S   v 1   i s   d e p r e c a t e d   ( s i n c e   K u b e r n e t e s   v 1 . 2 8 )   a n d   d i s a b l e d   b y   d e f a u l t   ( s i n c e   K u b e r n e t e s   v 1 . 2 9 ) .   K M S   v 2   o f f e r s   s i g n i f i c a n t l y   b e t t e r   p e r f o r m a n c e   c h a r a c t e r i s t i c s   t h a n   K M S   v 1 .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T h e   v e r s i o n   o f   K u b e r n e t e s   t h a t   y o u   n e e d   d e p e n d s   o n   w h i c h   K M S   A P I   v e r s i o n   y o u   h a v e   s e l e c t e d .   K u b e r n e t e s   r e c o m m e n d s   u s i n g   K M S   v 2 .   I f   y o u   s e l e c t e d   K M S   A P I   v 1   t o   s u p p o r t   c l u s t e r s   p r i o r   t o   v e r s i o n   v 1 . 2 7   o r   i f   y o u   h a v e   a   l e g a c y   K M S   p l u g i n   t h a t   o n l y   s u p p o r t s   K M S   v 1 ,   a n y   s u p p o r t e d   K u b e r n e t e s   v e r s i o n   w i l l   w o r k .   T h i s   A P I   i s   d e p r e c a t e d   a s   o f   K u b e r n e t e s   v 1 . 2 8 .   K u b e r n e t e s   d o e s   n o t   r e c o m m e n d   t h e   u s e   o f   t h i s   A P I .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is KMS v1?

Answer: K u b e r n e t e s   v e r s i o n   1 . 1 0 . 0   o r   l a t e r   i s   r e q u i r e d F o r   v e r s i o n   1 . 2 9   a n d   l a t e r ,   t h e   v 1   i m p l e m e n t a t i o n   o f   K M S   i s   d i s a b l e d   b y   d e f a u l t .   T o   e n a b l e   t h e   f e a t u r e ,   s e t   - - f e a t u r e - g a t e s = K M S v 1 = t r u e   t o   c o n f i g u r e   a   K M S   v 1   p r o v i d e r . Y o u r   c l u s t e r   m u s t   u s e   e t c d   v 3   o r   l a t e r   K u b e r n e t e s   v e r s i o n   1 . 1 0 . 0   o r   l a t e r   i s   r e q u i r e d   F o r   v e r s i o n   1 . 2 9   a n d   l a t e r ,   t h e   v 1   i m p l e m e n t a t i o n   o f   K M S   i s   d i s a b l e d   b y   d e f a u l t .   T o   e n a b l e   t h e   f e a t u r e ,   s e t   - - f e a t u r e - g a t e s = K M S v 1 = t r u e   t o   c o n f i g u r e   a   K M S   v 1   p r o v i d e r .   Y o u r   c l u s t e r   m u s t   u s e   e t c d   v 3   o r   l a t e r


Question: What is KMS v2?

Answer: Y o u r   c l u s t e r   m u s t   u s e   e t c d   v 3   o r   l a t e r


Question: What is KMS encryption and per-object encryption keys?

Answer: T h e   K M S   e n c r y p t i o n   p r o v i d e r   u s e s   a n   e n v e l o p e   e n c r y p t i o n   s c h e m e   t o   e n c r y p t   d a t a   i n   e t c d .   T h e   d a t a   i s   e n c r y p t e d   u s i n g   a   d a t a   e n c r y p t i o n   k e y   ( D E K ) .   T h e   D E K s   a r e   e n c r y p t e d   w i t h   a   k e y   e n c r y p t i o n   k e y   ( K E K )   t h a t   i s   s t o r e d   a n d   m a n a g e d   i n   a   r e m o t e   K M S .   I f   y o u   u s e   t h e   ( d e p r e c a t e d )   v 1   i m p l e m e n t a t i o n   o f   K M S ,   a   n e w   D E K   i s   g e n e r a t e d   f o r   e a c h   e n c r y p t i o n .   W i t h   K M S   v 2 ,   a   n e w   D E K   i s   g e n e r a t e d   p e r   e n c r y p t i o n :   t h e   A P I   s e r v e r   u s e s   a   k e y   d e r i v a t i o n   f u n c t i o n   t o   g e n e r a t e   s i n g l e   u s e   d a t a   e n c r y p t i o n   k e y s   f r o m   a   s e c r e t   s e e d   c o m b i n e d   w i t h   s o m e   r a n d o m   d a t a .   T h e   s e e d   i s   r o t a t e d   w h e n e v e r   t h e   K E K   i s   r o t a t e d   ( s e e   t h e   U n d e r s t a n d i n g   k e y _ i d   a n d   K e y   R o t a t i o n   s e c t i o n   b e l o w   f o r   m o r e   d e t a i l s ) .   T h e   K M S   p r o v i d e r   u s e s   g R P C   t o   c o m m u n i c a t e   w i t h   a   s p e c i f i c   K M S   p l u g i n   o v e r   a   U N I X   d o m a i n   s o c k e t .   T h e   K M S   p l u g i n ,   w h i c h   i s   i m p l e m e n t e d   a s   a   g R P C   s e r v e r   a n d   d e p l o y e d   o n   t h e   s a m e   h o s t ( s )   a s   t h e   K u b e r n e t e s   c o n t r o l   p l a n e ,   i s   r e s p o n s i b l e   f o r   a l l   c o m m u n i c a t i o n   w i t h   t h e   r e m o t e   K M S .


Question: What is Configuring the KMS provider?

Answer: T o   c o n f i g u r e   a   K M S   p r o v i d e r   o n   t h e   A P I   s e r v e r ,   i n c l u d e   a   p r o v i d e r   o f   t y p e   k m s   i n   t h e   p r o v i d e r s   a r r a y   i n   t h e   e n c r y p t i o n   c o n f i g u r a t i o n   f i l e   a n d   s e t   t h e   f o l l o w i n g   p r o p e r t i e s :


Question: What is KMS v1?

Answer: a p i V e r s i o n :   A P I   V e r s i o n   f o r   K M S   p r o v i d e r .   L e a v e   t h i s   v a l u e   e m p t y   o r   s e t   i t   t o   v 1 . n a m e :   D i s p l a y   n a m e   o f   t h e   K M S   p l u g i n .   C a n n o t   b e   c h a n g e d   o n c e   s e t . e n d p o i n t :   L i s t e n   a d d r e s s   o f   t h e   g R P C   s e r v e r   ( K M S   p l u g i n ) .   T h e   e n d p o i n t   i s   a   U N I X   d o m a i n   s o c k e t . c a c h e s i z e :   N u m b e r   o f   d a t a   e n c r y p t i o n   k e y s   ( D E K s )   t o   b e   c a c h e d   i n   t h e   c l e a r .   W h e n   c a c h e d ,   D E K s   c a n   b e   u s e d   w i t h o u t   a n o t h e r   c a l l   t o   t h e   K M S ;   w h e r e a s   D E K s   t h a t   a r e   n o t   c a c h e d   r e q u i r e   a   c a l l   t o   t h e   K M S   t o   u n w r a p . t i m e o u t :   H o w   l o n g   s h o u l d   k u b e - a p i s e r v e r   w a i t   f o r   k m s - p l u g i n   t o   r e s p o n d   b e f o r e   r e t u r n i n g   a n   e r r o r   ( d e f a u l t   i s   3   s e c o n d s ) .


Question: What is KMS v2?

Answer: a p i V e r s i o n :   A P I   V e r s i o n   f o r   K M S   p r o v i d e r .   S e t   t h i s   t o   v 2 . n a m e :   D i s p l a y   n a m e   o f   t h e   K M S   p l u g i n .   C a n n o t   b e   c h a n g e d   o n c e   s e t . e n d p o i n t :   L i s t e n   a d d r e s s   o f   t h e   g R P C   s e r v e r   ( K M S   p l u g i n ) .   T h e   e n d p o i n t   i s   a   U N I X   d o m a i n   s o c k e t . t i m e o u t :   H o w   l o n g   s h o u l d   k u b e - a p i s e r v e r   w a i t   f o r   k m s - p l u g i n   t o   r e s p o n d   b e f o r e   r e t u r n i n g   a n   e r r o r   ( d e f a u l t   i s   3   s e c o n d s ) .   K M S   v 2   d o e s   n o t   s u p p o r t   t h e   c a c h e s i z e   p r o p e r t y .   A l l   d a t a   e n c r y p t i o n   k e y s   ( D E K s )   w i l l   b e   c a c h e d   i n   t h e   c l e a r   o n c e   t h e   s e r v e r   h a s   u n w r a p p e d   t h e m   v i a   a   c a l l   t o   t h e   K M S .   O n c e   c a c h e d ,   D E K s   c a n   b e   u s e d   t o   p e r f o r m   d e c r y p t i o n   i n d e f i n i t e l y   w i t h o u t   m a k i n g   a   c a l l   t o   t h e   K M S .   S e e   U n d e r s t a n d i n g   t h e   e n c r y p t i o n   a t   r e s t   c o n f i g u r a t i o n .


Question: What is Implementing a KMS plugin?

Answer: T o   i m p l e m e n t   a   K M S   p l u g i n ,   y o u   c a n   d e v e l o p   a   n e w   p l u g i n   g R P C   s e r v e r   o r   e n a b l e   a   K M S   p l u g i n   a l r e a d y   p r o v i d e d   b y   y o u r   c l o u d   p r o v i d e r .   Y o u   t h e n   i n t e g r a t e   t h e   p l u g i n   w i t h   t h e   r e m o t e   K M S   a n d   d e p l o y   i t   o n   t h e   K u b e r n e t e s   c o n t r o l   p l a n e .


Question: What is Enabling the KMS supported by your cloud provider?

Answer: R e f e r   t o   y o u r   c l o u d   p r o v i d e r   f o r   i n s t r u c t i o n s   o n   e n a b l i n g   t h e   c l o u d   p r o v i d e r - s p e c i f i c   K M S   p l u g i n .


Question: What is Developing a KMS plugin gRPC server?

Answer: Y o u   c a n   d e v e l o p   a   K M S   p l u g i n   g R P C   s e r v e r   u s i n g   a   s t u b   f i l e   a v a i l a b l e   f o r   G o .   F o r   o t h e r   l a n g u a g e s ,   y o u   u s e   a   p r o t o   f i l e   t o   c r e a t e   a   s t u b   f i l e   t h a t   y o u   c a n   u s e   t o   d e v e l o p   t h e   g R P C   s e r v e r   c o d e .


Question: What is KMS v1?

Answer: U s i n g   G o :   U s e   t h e   f u n c t i o n s   a n d   d a t a   s t r u c t u r e s   i n   t h e   s t u b   f i l e :   a p i . p b . g o   t o   d e v e l o p   t h e   g R P C   s e r v e r   c o d e U s i n g   l a n g u a g e s   o t h e r   t h a n   G o :   U s e   t h e   p r o t o c   c o m p i l e r   w i t h   t h e   p r o t o   f i l e :   a p i . p r o t o   t o   g e n e r a t e   a   s t u b   f i l e   f o r   t h e   s p e c i f i c   l a n g u a g e   U s i n g   G o :   U s e   t h e   f u n c t i o n s   a n d   d a t a   s t r u c t u r e s   i n   t h e   s t u b   f i l e :   a p i . p b . g o   t o   d e v e l o p   t h e   g R P C   s e r v e r   c o d e   U s i n g   l a n g u a g e s   o t h e r   t h a n   G o :   U s e   t h e   p r o t o c   c o m p i l e r   w i t h   t h e   p r o t o   f i l e :   a p i . p r o t o   t o   g e n e r a t e   a   s t u b   f i l e   f o r   t h e   s p e c i f i c   l a n g u a g e


Question: What is KMS v2?

Answer: U s i n g   G o :   A   h i g h   l e v e l   l i b r a r y   i s   p r o v i d e d   t o   m a k e   t h e   p r o c e s s   e a s i e r .   L o w   l e v e l   i m p l e m e n t a t i o n s   c a n   u s e   t h e   f u n c t i o n s   a n d   d a t a   s t r u c t u r e s   i n   t h e   s t u b   f i l e :   a p i . p b . g o   t o   d e v e l o p   t h e   g R P C   s e r v e r   c o d e U s i n g   l a n g u a g e s   o t h e r   t h a n   G o :   U s e   t h e   p r o t o c   c o m p i l e r   w i t h   t h e   p r o t o   f i l e :   a p i . p r o t o   t o   g e n e r a t e   a   s t u b   f i l e   f o r   t h e   s p e c i f i c   l a n g u a g e   U s i n g   G o :   A   h i g h   l e v e l   l i b r a r y   i s   p r o v i d e d   t o   m a k e   t h e   p r o c e s s   e a s i e r .   L o w   l e v e l   i m p l e m e n t a t i o n s   c a n   u s e   t h e   f u n c t i o n s   a n d   d a t a   s t r u c t u r e s   i n   t h e   s t u b   f i l e :   a p i . p b . g o   t o   d e v e l o p   t h e   g R P C   s e r v e r   c o d e   U s i n g   l a n g u a g e s   o t h e r   t h a n   G o :   U s e   t h e   p r o t o c   c o m p i l e r   w i t h   t h e   p r o t o   f i l e :   a p i . p r o t o   t o   g e n e r a t e   a   s t u b   f i l e   f o r   t h e   s p e c i f i c   l a n g u a g e   T h e n   u s e   t h e   f u n c t i o n s   a n d   d a t a   s t r u c t u r e s   i n   t h e   s t u b   f i l e   t o   d e v e l o p   t h e   s e r v e r   c o d e .


Question: What is KMS v1?

Answer: k m s   p l u g i n   v e r s i o n :   v 1 b e t a 1 I n   r e s p o n s e   t o   p r o c e d u r e   c a l l   V e r s i o n ,   a   c o m p a t i b l e   K M S   p l u g i n   s h o u l d   r e t u r n   v 1 b e t a 1   a s   V e r s i o n R e s p o n s e . v e r s i o n . m e s s a g e   v e r s i o n :   v 1 b e t a 1 A l l   m e s s a g e s   f r o m   K M S   p r o v i d e r   h a v e   t h e   v e r s i o n   f i e l d   s e t   t o   v 1 b e t a 1 . p r o t o c o l :   U N I X   d o m a i n   s o c k e t   ( u n i x ) T h e   p l u g i n   i s   i m p l e m e n t e d   a s   a   g R P C   s e r v e r   t h a t   l i s t e n s   a t   U N I X   d o m a i n   s o c k e t .   T h e   p l u g i n   d e p l o y m e n t   s h o u l d   c r e a t e   a   f i l e   o n   t h e   f i l e   s y s t e m   t o   r u n   t h e   g R P C   u n i x   d o m a i n   s o c k e t   c o n n e c t i o n .   T h e   A P I   s e r v e r   ( g R P C   c l i e n t )   i s   c o n f i g u r e d   w i t h   t h e   K M S   p r o v i d e r   ( g R P C   s e r v e r )   u n i x   d o m a i n   s o c k e t   e n d p o i n t   i n   o r d e r   t o   c o m m u n i c a t e   w i t h   i t .   A n   a b s t r a c t   L i n u x   s o c k e t   m a y   b e   u s e d   b y   s t a r t i n g   t h e   e n d p o i n t   w i t h   / @ ,   i . e .   u n i x : / / / @ f o o .   C a r e   m u s t   b e   t a k e n   w h e n   u s i n g   t h i s   t y p e   o f   s o c k e t   a s   t h e y   d o   n o t   h a v e   c o n c e p t   o f   A C L   ( u n l i k e   t r a d i t i o n a l   f i l e   b a s e d   s o c k e t s ) .   H o w e v e r ,   t h e y   a r e   s u b j e c t   t o   L i n u x   n e t w o r k i n g   n a m e s p a c e ,   s o   w i l l   o n l y   b e   a c c e s s i b l e   t o   c o n t a i n e r s   w i t h i n   t h e   s a m e   p o d   u n l e s s   h o s t   n e t w o r k i n g   i s   u s e d .   k m s   p l u g i n   v e r s i o n :   v 1 b e t a 1   I n   r e s p o n s e


Question: What is KMS v2?

Answer: K M S   p l u g i n   v e r s i o n :   v 2 I n   r e s p o n s e   t o   t h e   S t a t u s   r e m o t e   p r o c e d u r e   c a l l ,   a   c o m p a t i b l e   K M S   p l u g i n   s h o u l d   r e t u r n   i t s   K M S   c o m p a t i b i l i t y   v e r s i o n   a s   S t a t u s R e s p o n s e . v e r s i o n .   T h a t   s t a t u s   r e s p o n s e   s h o u l d   a l s o   i n c l u d e   " o k "   a s   S t a t u s R e s p o n s e . h e a l t h z   a n d   a   k e y _ i d   ( r e m o t e   K M S   K E K   I D )   a s   S t a t u s R e s p o n s e . k e y _ i d .   T h e   K u b e r n e t e s   p r o j e c t   r e c o m m e n d s   y o u   m a k e   y o u r   p l u g i n   c o m p a t i b l e   w i t h   t h e   s t a b l e   v 2   K M S   A P I .   K u b e r n e t e s   1 . 3 4   a l s o   s u p p o r t s   t h e   v 2 b e t a 1   A P I   f o r   K M S ;   f u t u r e   K u b e r n e t e s   r e l e a s e s   a r e   l i k e l y   t o   c o n t i n u e   s u p p o r t i n g   t h a t   b e t a   v e r s i o n . T h e   A P I   s e r v e r   p o l l s   t h e   S t a t u s   p r o c e d u r e   c a l l   a p p r o x i m a t e l y   e v e r y   m i n u t e   w h e n   e v e r y t h i n g   i s   h e a l t h y ,   a n d   e v e r y   1 0   s e c o n d s   w h e n   t h e   p l u g i n   i s   n o t   h e a l t h y .   P l u g i n s   m u s t   t a k e   c a r e   t o   o p t i m i z e   t h i s   c a l l   a s   i t   w i l l   b e   u n d e r   c o n s t a n t   l o a d . E n c r y p t i o n T h e   E n c r y p t R e q u e s t   p r o c e d u r e   c a l l   p r o v i d e s   t h e   p l a i n t e x t   a n d   a   U I D   f o r   l o g g i n g   p u r p o s e s .   T h e   r e s p o n s e   m u s t   i n c l u d e   t h e   c i p h e r t e x t ,   t h e   k e y _ i d   f o r   t h e   K E K   u s e d ,   a n d ,   o p t i o n a l l y ,   a n y   m e t a d a t a   t h a t   t h e   K M S   p l u g i n   n e e d s   t o   a i d   i n   f u t u r


Question: What is Caution:?

Answer: p r o t o c o l :   U N I X   d o m a i n   s o c k e t   ( u n i x )   T h e   p l u g i n   i s   i m p l e m e n t e d   a s   a   g R P C   s e r v e r   t h a t   l i s t e n s   a t   U N I X   d o m a i n   s o c k e t .   T h e   p l u g i n   d e p l o y m e n t   s h o u l d   c r e a t e   a   f i l e   o n   t h e   f i l e   s y s t e m   t o   r u n   t h e   g R P C   u n i x   d o m a i n   s o c k e t   c o n n e c t i o n .   T h e   A P I   s e r v e r   ( g R P C   c l i e n t )   i s   c o n f i g u r e d   w i t h   t h e   K M S   p r o v i d e r   ( g R P C   s e r v e r )   u n i x   d o m a i n   s o c k e t   e n d p o i n t   i n   o r d e r   t o   c o m m u n i c a t e   w i t h   i t .   A n   a b s t r a c t   L i n u x   s o c k e t   m a y   b e   u s e d   b y   s t a r t i n g   t h e   e n d p o i n t   w i t h   / @ ,   i . e .   u n i x : / / / @ f o o .   C a r e   m u s t   b e   t a k e n   w h e n   u s i n g   t h i s   t y p e   o f   s o c k e t   a s   t h e y   d o   n o t   h a v e   c o n c e p t   o f   A C L   ( u n l i k e   t r a d i t i o n a l   f i l e   b a s e d   s o c k e t s ) .   H o w e v e r ,   t h e y   a r e   s u b j e c t   t o   L i n u x   n e t w o r k i n g   n a m e s p a c e ,   s o   w i l l   o n l y   b e   a c c e s s i b l e   t o   c o n t a i n e r s   w i t h i n   t h e   s a m e   p o d   u n l e s s   h o s t   n e t w o r k i n g   i s   u s e d .


Question: What is Integrating a KMS plugin with the remote KMS?

Answer: T h e   K M S   p l u g i n   c a n   c o m m u n i c a t e   w i t h   t h e   r e m o t e   K M S   u s i n g   a n y   p r o t o c o l   s u p p o r t e d   b y   t h e   K M S .   A l l   c o n f i g u r a t i o n   d a t a ,   i n c l u d i n g   a u t h e n t i c a t i o n   c r e d e n t i a l s   t h e   K M S   p l u g i n   u s e s   t o   c o m m u n i c a t e   w i t h   t h e   r e m o t e   K M S ,   a r e   s t o r e d   a n d   m a n a g e d   b y   t h e   K M S   p l u g i n   i n d e p e n d e n t l y .   T h e   K M S   p l u g i n   c a n   e n c o d e   t h e   c i p h e r t e x t   w i t h   a d d i t i o n a l   m e t a d a t a   t h a t   m a y   b e   r e q u i r e d   b e f o r e   s e n d i n g   i t   t o   t h e   K M S   f o r   d e c r y p t i o n   ( K M S   v 2   m a k e s   t h i s   p r o c e s s   e a s i e r   b y   p r o v i d i n g   a   d e d i c a t e d   a n n o t a t i o n s   f i e l d ) .


Question: What is Deploying the KMS plugin?

Answer: E n s u r e   t h a t   t h e   K M S   p l u g i n   r u n s   o n   t h e   s a m e   h o s t ( s )   a s   t h e   K u b e r n e t e s   A P I   s e r v e r ( s ) .


Question: What is Encrypting your data with the KMS provider?

Answer: T o   e n c r y p t   t h e   d a t a :   C r e a t e   a   n e w   E n c r y p t i o n C o n f i g u r a t i o n   f i l e   u s i n g   t h e   a p p r o p r i a t e   p r o p e r t i e s   f o r   t h e   k m s   p r o v i d e r   t o   e n c r y p t   r e s o u r c e s   l i k e   S e c r e t s   a n d   C o n f i g M a p s .   I f   y o u   w a n t   t o   e n c r y p t   a n   e x t e n s i o n   A P I   t h a t   i s   d e f i n e d   i n   a   C u s t o m R e s o u r c e D e f i n i t i o n ,   y o u r   c l u s t e r   m u s t   b e   r u n n i n g   K u b e r n e t e s   v 1 . 2 6   o r   n e w e r . S e t   t h e   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   f l a g   o n   t h e   k u b e - a p i s e r v e r   t o   p o i n t   t o   t h e   l o c a t i o n   o f   t h e   c o n f i g u r a t i o n   f i l e . - - e n c r y p t i o n - p r o v i d e r - c o n f i g - a u t o m a t i c - r e l o a d   b o o l e a n   a r g u m e n t   d e t e r m i n e s   i f   t h e   f i l e   s e t   b y   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   s h o u l d   b e   a u t o m a t i c a l l y   r e l o a d e d   i f   t h e   d i s k   c o n t e n t s   c h a n g e . R e s t a r t   y o u r   A P I   s e r v e r .   C r e a t e   a   n e w   E n c r y p t i o n C o n f i g u r a t i o n   f i l e   u s i n g   t h e   a p p r o p r i a t e   p r o p e r t i e s   f o r   t h e   k m s   p r o v i d e r   t o   e n c r y p t   r e s o u r c e s   l i k e   S e c r e t s   a n d   C o n f i g M a p s .   I f   y o u   w a n t   t o   e n c r y p t   a n   e x t e n s i o n   A P I   t h a t   i s   d e f i n e d   i n   a   C u s t o m R e s o u r c e D e f i n i t i o n ,   y o u r   c l u s t e r   m u s t   b e   r u n n i n g   K u b e r n e t e s   v 1 . 2 6   o r   n e w e r .   S e t   t h e   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   f l a g   o n   t h e   k u b e - a p i s e r v e r   t o   p o i n t   t o   t h e


Question: What is KMS v1?

Answer: a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   E n c r y p t i o n C o n f i g u r a t i o n   r e s o u r c e s :   -   r e s o u r c e s :   -   s e c r e t s   -   c o n f i g m a p s   -   p a n d a s . a w e s o m e . b e a r s . e x a m p l e   p r o v i d e r s :   -   k m s :   n a m e :   m y K m s P l u g i n F o o   e n d p o i n t :   u n i x : / / / t m p / s o c k e t f i l e - f o o . s o c k   c a c h e s i z e :   1 0 0   t i m e o u t :   3 s   -   k m s :   n a m e :   m y K m s P l u g i n B a r   e n d p o i n t :   u n i x : / / / t m p / s o c k e t f i l e - b a r . s o c k   c a c h e s i z e :   1 0 0   t i m e o u t :   3 s