Question: What is Periodic review?

Answer: I t   i s   v i t a l   t o   p e r i o d i c a l l y   r e v i e w   t h e   K u b e r n e t e s   R B A C   s e t t i n g s   f o r   r e d u n d a n t   e n t r i e s   a n d   p o s s i b l e   p r i v i l e g e   e s c a l a t i o n s .   I f   a n   a t t a c k e r   i s   a b l e   t o   c r e a t e   a   u s e r   a c c o u n t   w i t h   t h e   s a m e   n a m e   a s   a   d e l e t e d   u s e r ,   t h e y   c a n   a u t o m a t i c a l l y   i n h e r i t   a l l   t h e   r i g h t s   o f   t h e   d e l e t e d   u s e r ,   e s p e c i a l l y   t h e   r i g h t s   a s s i g n e d   t o   t h a t   u s e r .


Question: What is Kubernetes RBAC - privilege escalation risks?

Answer: W i t h i n   K u b e r n e t e s   R B A C   t h e r e   a r e   a   n u m b e r   o f   p r i v i l e g e s   w h i c h ,   i f   g r a n t e d ,   c a n   a l l o w   a   u s e r   o r   a   s e r v i c e   a c c o u n t   t o   e s c a l a t e   t h e i r   p r i v i l e g e s   i n   t h e   c l u s t e r   o r   a f f e c t   s y s t e m s   o u t s i d e   t h e   c l u s t e r .   T h i s   s e c t i o n   i s   i n t e n d e d   t o   p r o v i d e   v i s i b i l i t y   o f   t h e   a r e a s   w h e r e   c l u s t e r   o p e r a t o r s   s h o u l d   t a k e   c a r e ,   t o   e n s u r e   t h a t   t h e y   d o   n o t   i n a d v e r t e n t l y   a l l o w   f o r   m o r e   a c c e s s   t o   c l u s t e r s   t h a n   i n t e n d e d .


Question: What is Listing secrets?

Answer: I t   i s   g e n e r a l l y   c l e a r   t h a t   a l l o w i n g   g e t   a c c e s s   o n   S e c r e t s   w i l l   a l l o w   a   u s e r   t o   r e a d   t h e i r   c o n t e n t s .   I t   i s   a l s o   i m p o r t a n t   t o   n o t e   t h a t   l i s t   a n d   w a t c h   a c c e s s   a l s o   e f f e c t i v e l y   a l l o w   f o r   u s e r s   t o   r e v e a l   t h e   S e c r e t   c o n t e n t s .   F o r   e x a m p l e ,   w h e n   a   L i s t   r e s p o n s e   i s   r e t u r n e d   ( f o r   e x a m p l e ,   v i a   k u b e c t l   g e t   s e c r e t s   - A   - o   y a m l ) ,   t h e   r e s p o n s e   i n c l u d e s   t h e   c o n t e n t s   o f   a l l   S e c r e t s .


Question: What is Workload creation?

Answer: P e r m i s s i o n   t o   c r e a t e   w o r k l o a d s   ( e i t h e r   P o d s ,   o r   w o r k l o a d   r e s o u r c e s   t h a t   m a n a g e   P o d s )   i n   a   n a m e s p a c e   i m p l i c i t l y   g r a n t s   a c c e s s   t o   m a n y   o t h e r   r e s o u r c e s   i n   t h a t   n a m e s p a c e ,   s u c h   a s   S e c r e t s ,   C o n f i g M a p s ,   a n d   P e r s i s t e n t V o l u m e s   t h a t   c a n   b e   m o u n t e d   i n   P o d s .   A d d i t i o n a l l y ,   s i n c e   P o d s   c a n   r u n   a s   a n y   S e r v i c e A c c o u n t ,   g r a n t i n g   p e r m i s s i o n   t o   c r e a t e   w o r k l o a d s   a l s o   i m p l i c i t l y   g r a n t s   t h e   A P I   a c c e s s   l e v e l s   o f   a n y   s e r v i c e   a c c o u n t   i n   t h a t   n a m e s p a c e .   U s e r s   w h o   c a n   r u n   p r i v i l e g e d   P o d s   c a n   u s e   t h a t   a c c e s s   t o   g a i n   n o d e   a c c e s s   a n d   p o t e n t i a l l y   t o   f u r t h e r   e l e v a t e   t h e i r   p r i v i l e g e s .   W h e r e   y o u   d o   n o t   f u l l y   t r u s t   a   u s e r   o r   o t h e r   p r i n c i p a l   w i t h   t h e   a b i l i t y   t o   c r e a t e   s u i t a b l y   s e c u r e   a n d   i s o l a t e d   P o d s ,   y o u   s h o u l d   e n f o r c e   e i t h e r   t h e   B a s e l i n e   o r   R e s t r i c t e d   P o d   S e c u r i t y   S t a n d a r d .   Y o u   c a n   u s e   P o d   S e c u r i t y   a d m i s s i o n   o r   o t h e r   ( t h i r d   p a r t y )   m e c h a n i s m s   t o   i m p l e m e n t   t h a t   e n f o r c e m e n t .   F o r   t h e s e   r e a s o n s ,   n a m e s p a c e s   s h o u l d   b e   u s e d   t o   s e p a r a t e   r e s o u r c e s   r e q u i r i n g   d i f f e r e n t   l e v e l s   o f   t r u s t   o r   t e n a n c y .   I t   i s   s t i l l   c o n s i d e r e d   b e s t   p r a c t i


Question: What is Persistent volume creation?

Answer: I f   s o m e o n e   -   o r   s o m e   a p p l i c a t i o n   -   i s   a l l o w e d   t o   c r e a t e   a r b i t r a r y   P e r s i s t e n t V o l u m e s ,   t h a t   a c c e s s   i n c l u d e s   t h e   c r e a t i o n   o f   h o s t P a t h   v o l u m e s ,   w h i c h   t h e n   m e a n s   t h a t   a   P o d   w o u l d   g e t   a c c e s s   t o   t h e   u n d e r l y i n g   h o s t   f i l e s y s t e m ( s )   o n   t h e   a s s o c i a t e d   n o d e .   G r a n t i n g   t h a t   a b i l i t y   i s   a   s e c u r i t y   r i s k .   T h e r e   a r e   m a n y   w a y s   a   c o n t a i n e r   w i t h   u n r e s t r i c t e d   a c c e s s   t o   t h e   h o s t   f i l e s y s t e m   c a n   e s c a l a t e   p r i v i l e g e s ,   i n c l u d i n g   r e a d i n g   d a t a   f r o m   o t h e r   c o n t a i n e r s ,   a n d   a b u s i n g   t h e   c r e d e n t i a l s   o f   s y s t e m   s e r v i c e s ,   s u c h   a s   K u b e l e t .   Y o u   s h o u l d   o n l y   a l l o w   a c c e s s   t o   c r e a t e   P e r s i s t e n t V o l u m e   o b j e c t s   f o r :   U s e r s   ( c l u s t e r   o p e r a t o r s )   t h a t   n e e d   t h i s   a c c e s s   f o r   t h e i r   w o r k ,   a n d   w h o   y o u   t r u s t . T h e   K u b e r n e t e s   c o n t r o l   p l a n e   c o m p o n e n t s   w h i c h   c r e a t e s   P e r s i s t e n t V o l u m e s   b a s e d   o n   P e r s i s t e n t V o l u m e C l a i m s   t h a t   a r e   c o n f i g u r e d   f o r   a u t o m a t i c   p r o v i s i o n i n g .   T h i s   i s   u s u a l l y   s e t u p   b y   t h e   K u b e r n e t e s   p r o v i d e r   o r   b y   t h e   o p e r a t o r   w h e n   i n s t a l l i n g   a   C S I   d r i v e r .   W h e r e   a c c e s s   t o   p e r s i s t e n t   s t o r a g e   i s   r e q u i r e d   t r u s t e d   a d m i n i s t r a t o r s   s h o u l d   c r e a t e   P e r s i s t e n t V


Question: What is Access to proxy subresource of Nodes?

Answer: U s e r s   w i t h   a c c e s s   t o   t h e   p r o x y   s u b - r e s o u r c e   o f   n o d e   o b j e c t s   h a v e   r i g h t s   t o   t h e   K u b e l e t   A P I ,   w h i c h   a l l o w s   f o r   c o m m a n d   e x e c u t i o n   o n   e v e r y   p o d   o n   t h e   n o d e ( s )   t o   w h i c h   t h e y   h a v e   r i g h t s .   T h i s   a c c e s s   b y p a s s e s   a u d i t   l o g g i n g   a n d   a d m i s s i o n   c o n t r o l ,   s o   c a r e   s h o u l d   b e   t a k e n   b e f o r e   g r a n t i n g   r i g h t s   t o   t h i s   r e s o u r c e .


Question: What is Escalate verb?

Answer: G e n e r a l l y ,   t h e   R B A C   s y s t e m   p r e v e n t s   u s e r s   f r o m   c r e a t i n g   c l u s t e r r o l e s   w i t h   m o r e   r i g h t s   t h a n   t h e   u s e r   p o s s e s s e s .   T h e   e x c e p t i o n   t o   t h i s   i s   t h e   e s c a l a t e   v e r b .   A s   n o t e d   i n   t h e   R B A C   d o c u m e n t a t i o n ,   u s e r s   w i t h   t h i s   r i g h t   c a n   e f f e c t i v e l y   e s c a l a t e   t h e i r   p r i v i l e g e s .


Question: What is Bind verb?

Answer: S i m i l a r   t o   t h e   e s c a l a t e   v e r b ,   g r a n t i n g   u s e r s   t h i s   r i g h t   a l l o w s   f o r   t h e   b y p a s s   o f   K u b e r n e t e s   i n - b u i l t   p r o t e c t i o n s   a g a i n s t   p r i v i l e g e   e s c a l a t i o n ,   a l l o w i n g   u s e r s   t o   c r e a t e   b i n d i n g s   t o   r o l e s   w i t h   r i g h t s   t h e y   d o   n o t   a l r e a d y   h a v e .


Question: What is Impersonate verb?

Answer: T h i s   v e r b   a l l o w s   u s e r s   t o   i m p e r s o n a t e   a n d   g a i n   t h e   r i g h t s   o f   o t h e r   u s e r s   i n   t h e   c l u s t e r .   C a r e   s h o u l d   b e   t a k e n   w h e n   g r a n t i n g   i t ,   t o   e n s u r e   t h a t   e x c e s s i v e   p e r m i s s i o n s   c a n n o t   b e   g a i n e d   v i a   o n e   o f   t h e   i m p e r s o n a t e d   a c c o u n t s .


Question: What is CSRs and certificate issuing?

Answer: T h e   C S R   A P I   a l l o w s   f o r   u s e r s   w i t h   c r e a t e   r i g h t s   t o   C S R s   a n d   u p d a t e   r i g h t s   o n   c e r t i f i c a t e s i g n i n g r e q u e s t s / a p p r o v a l   w h e r e   t h e   s i g n e r   i s   k u b e r n e t e s . i o / k u b e - a p i s e r v e r - c l i e n t   t o   c r e a t e   n e w   c l i e n t   c e r t i f i c a t e s   w h i c h   a l l o w   u s e r s   t o   a u t h e n t i c a t e   t o   t h e   c l u s t e r .   T h o s e   c l i e n t   c e r t i f i c a t e s   c a n   h a v e   a r b i t r a r y   n a m e s   i n c l u d i n g   d u p l i c a t e s   o f   K u b e r n e t e s   s y s t e m   c o m p o n e n t s .   T h i s   w i l l   e f f e c t i v e l y   a l l o w   f o r   p r i v i l e g e   e s c a l a t i o n .


Question: What is Token request?

Answer: U s e r s   w i t h   c r e a t e   r i g h t s   o n   s e r v i c e a c c o u n t s / t o k e n   c a n   c r e a t e   T o k e n R e q u e s t s   t o   i s s u e   t o k e n s   f o r   e x i s t i n g   s e r v i c e   a c c o u n t s .


Question: What is Control admission webhooks?

Answer: U s e r s   w i t h   c o n t r o l   o v e r   v a l i d a t i n g w e b h o o k c o n f i g u r a t i o n s   o r   m u t a t i n g w e b h o o k c o n f i g u r a t i o n s   c a n   c o n t r o l   w e b h o o k s   t h a t   c a n   r e a d   a n y   o b j e c t   a d m i t t e d   t o   t h e   c l u s t e r ,   a n d   i n   t h e   c a s e   o f   m u t a t i n g   w e b h o o k s ,   a l s o   m u t a t e   a d m i t t e d   o b j e c t s .


Question: What is Namespace modification?

Answer: U s e r s   w h o   c a n   p e r f o r m   p a t c h   o p e r a t i o n s   o n   N a m e s p a c e   o b j e c t s   ( t h r o u g h   a   n a m e s p a c e d   R o l e B i n d i n g   t o   a   R o l e   w i t h   t h a t   a c c e s s )   c a n   m o d i f y   l a b e l s   o n   t h a t   n a m e s p a c e .   I n   c l u s t e r s   w h e r e   P o d   S e c u r i t y   A d m i s s i o n   i s   u s e d ,   t h i s   m a y   a l l o w   a   u s e r   t o   c o n f i g u r e   t h e   n a m e s p a c e   f o r   a   m o r e   p e r m i s s i v e   p o l i c y   t h a n   i n t e n d e d   b y   t h e   a d m i n i s t r a t o r s .   F o r   c l u s t e r s   w h e r e   N e t w o r k P o l i c y   i s   u s e d ,   u s e r s   m a y   b e   s e t   l a b e l s   t h a t   i n d i r e c t l y   a l l o w   a c c e s s   t o   s e r v i c e s   t h a t   a n   a d m i n i s t r a t o r   d i d   n o t   i n t e n d   t o   a l l o w .


Question: What is Object creation denial-of-service?

Answer: U s e r s   w h o   h a v e   r i g h t s   t o   c r e a t e   o b j e c t s   i n   a   c l u s t e r   m a y   b e   a b l e   t o   c r e a t e   s u f f i c i e n t   l a r g e   o b j e c t s   t o   c r e a t e   a   d e n i a l   o f   s e r v i c e   c o n d i t i o n   e i t h e r   b a s e d   o n   t h e   s i z e   o r   n u m b e r   o f   o b j e c t s ,   a s   d i s c u s s e d   i n   e t c d   u s e d   b y   K u b e r n e t e s   i s   v u l n e r a b l e   t o   O O M   a t t a c k .   T h i s   m a y   b e   s p e c i f i c a l l y   r e l e v a n t   i n   m u l t i - t e n a n t   c l u s t e r s   i f   s e m i - t r u s t e d   o r   u n t r u s t e d   u s e r s   a r e   a l l o w e d   l i m i t e d   a c c e s s   t o   a   s y s t e m .   O n e   o p t i o n   f o r   m i t i g a t i o n   o f   t h i s   i s s u e   w o u l d   b e   t o   u s e   r e s o u r c e   q u o t a s   t o   l i m i t   t h e   q u a n t i t y   o f   o b j e c t s   w h i c h   c a n   b e   c r e a t e d .


Question: What is What's next?

Answer: T o   l e a r n   m o r e   a b o u t   R B A C ,   s e e   t h e   R B A C   d o c u m e n t a t i o n .


Question: What is Namespaces?

Answer: NamespacesIn Kubernetes, namespaces provide a mechanism for isolating groups of resources within a single cluster. Names of resources need to be unique within a namespace, but not across namespaces. Namespace-based scoping is applicable only for namespaced objects (e.g. Deployments, Services, etc.) and not for cluster-wide objects (e.g. StorageClass, Nodes, PersistentVolumes, etc.).When to Use Multiple NamespacesNamespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. Start using namespaces when you need the features they provide.Namespaces provide a scope for names. Names of resources need to be unique within a namespace, but not across namespaces. Namespaces cannot be nested inside one another and each Kubernetes resource can only be in one namespace.Namespaces are a way to divide cluster resources between multiple users (via resource quota).It is not necessary to use multiple namespaces to separate slightly different resources, such as different versions of the same software: use labels to distinguish resources within the same namespace.Note:For a production cluster, consider not using the default namespace. Instead, make other namespaces and use those.Initial namespacesKubernetes starts with four initial namespaces:defaultKubernetes includes this namespace so that you can start using your new cluster without first creating a namespace.kube-node-leaseThis namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.kube-publicThis namespace is readable by all clients (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.kube-systemThe namespace for objects created by the Kubernetes system.Working with NamespacesCreation and deletion of namespaces are described in the Admin Guide documentation for namespaces.Note:Avoid creating namespaces with the prefix kube-, since it is reserved for Kubernetes system namespaces.Viewing namespacesYou can list the current namespaces in a cluster using:kubectl get namespace NAME STATUS AGE default Active 1d kube-node-lease Active 1d kube-public Active 1d kube-system Active 1d Setting the namespace for a requestTo set the namespace for a current request, use the --namespace flag.For example:kubectl run nginx --image=nginx --namespace=<insert-namespace-name-here> kubectl get pods --namespace=<insert-namespace-name-here> Setting the namespace preferenceYou can permanently save the namespace for all subsequent kubectl commands in that context.kubectl config set-context --current --namespace=<insert-namespace-name-here> # Validate it kubectl config view --minify |


Question: How does Namespaces work?

Answer: NamespacesIn Kubernetes, namespaces provide a mechanism for isolating groups of resources within a single cluster. Names of resources need to be unique within a namespace, but not across namespaces. Namespace-based scoping is applicable only for namespaced objects (e.g. Deployments, Services, etc.) and not for cluster-wide objects (e.g. StorageClass, Nodes, PersistentVolumes, etc.).When to Use Multiple NamespacesNamespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. Start using namespaces when you need the features they provide.Namespaces provide a scope for names. Names of resources need to be unique within a namespace, but not across namespaces. Namespaces cannot be nested inside one another and each Kubernetes resource can only be in one namespace.Namespaces are a way to divide cluster resources between multiple users (via resource quota).It is not necessary to use multiple namespaces to separate slightly different resources, such as different versions of the same software: use labels to distinguish resources within the same namespace.Note:For a production cluster, consider not using the default namespace. Instead, make other namespaces and use those.Initial namespacesKubernetes starts with four initial namespaces:defaultKubernetes includes this namespace so that you can start using your new cluster without first creating a namespace.kube-node-leaseThis namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.kube-publicThis namespace is readable by all clients (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.kube-systemThe namespace for objects created by the Kubernetes system.Working with NamespacesCreation and deletion of namespaces are described in the Admin Guide documentation for namespaces.Note:Avoid creating namespaces with the prefix kube-, since it is reserved for Kubernetes system namespaces.Viewing namespacesYou can list the current namespaces in a cluster using:kubectl get namespace NAME STATUS AGE default Active 1d kube-node-lease Active 1d kube-public Active 1d kube-system Active 1d Setting the namespace for a requestTo set the namespace for a current request, use the --namespace flag.For example:kubectl run nginx --image=nginx --namespace=<insert-namespace-name-here> kubectl get pods --namespace=<insert-namespace-name-here> Setting the namespace preferenceYou can permanently save the namespace for all subsequent kubectl commands in that context.kubectl config set-context --current --namespace=<insert-namespace-name-here> # Validate it kubectl config view --minify |


Question: When would you use Namespaces?

Answer: NamespacesIn Kubernetes, namespaces provide a mechanism for isolating groups of resources within a single cluster. Names of resources need to be unique within a namespace, but not across namespaces. Namespace-based scoping is applicable only for namespaced objects (e.g. Deployments, Services, etc.) and not for cluster-wide objects (e.g. StorageClass, Nodes, PersistentVolumes, etc.).When to Use Multiple NamespacesNamespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. Start using namespaces when you need the features they provide.Namespaces provide a scope for names. Names of resources need to be unique within a namespace, but not across namespaces. Namespaces cannot be nested inside one another and each Kubernetes resource can only be in one namespace.Namespaces are a way to divide cluster resources between multiple users (via resource quota).It is not necessary to use multiple namespaces to separate slightly different resources, such as different versions of the same software: use labels to distinguish resources within the same namespace.Note:For a production cluster, consider not using the default namespace. Instead, make other namespaces and use those.Initial namespacesKubernetes starts with four initial namespaces:defaultKubernetes includes this namespace so that you can start using your new cluster without first creating a namespace.kube-node-leaseThis namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.kube-publicThis namespace is readable by all clients (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.kube-systemThe namespace for objects created by the Kubernetes system.Working with NamespacesCreation and deletion of namespaces are described in the Admin Guide documentation for namespaces.Note:Avoid creating namespaces with the prefix kube-, since it is reserved for Kubernetes system namespaces.Viewing namespacesYou can list the current namespaces in a cluster using:kubectl get namespace NAME STATUS AGE default Active 1d kube-node-lease Active 1d kube-public Active 1d kube-system Active 1d Setting the namespace for a requestTo set the namespace for a current request, use the --namespace flag.For example:kubectl run nginx --image=nginx --namespace=<insert-namespace-name-here> kubectl get pods --namespace=<insert-namespace-name-here> Setting the namespace preferenceYou can permanently save the namespace for all subsequent kubectl commands in that context.kubectl config set-context --current --namespace=<insert-namespace-name-here> # Validate it kubectl config view --minify |


Question: What are the benefits of Namespaces?

Answer: NamespacesIn Kubernetes, namespaces provide a mechanism for isolating groups of resources within a single cluster. Names of resources need to be unique within a namespace, but not across namespaces. Namespace-based scoping is applicable only for namespaced objects (e.g. Deployments, Services, etc.) and not for cluster-wide objects (e.g. StorageClass, Nodes, PersistentVolumes, etc.).When to Use Multiple NamespacesNamespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. Start using namespaces when you need the features they provide.Namespaces provide a scope for names. Names of resources need to be unique within a namespace, but not across namespaces. Namespaces cannot be nested inside one another and each Kubernetes resource can only be in one namespace.Namespaces are a way to divide cluster resources between multiple users (via resource quota).It is not necessary to use multiple namespaces to separate slightly different resources, such as different versions of the same software: use labels to distinguish resources within the same namespace.Note:For a production cluster, consider not using the default namespace. Instead, make other namespaces and use those.Initial namespacesKubernetes starts with four initial namespaces:defaultKubernetes includes this namespace so that you can start using your new cluster without first creating a namespace.kube-node-leaseThis namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.kube-publicThis namespace is readable by all clients (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.kube-systemThe namespace for objects created by the Kubernetes system.Working with NamespacesCreation and deletion of namespaces are described in the Admin Guide documentation for namespaces.Note:Avoid creating namespaces with the prefix kube-, since it is reserved for Kubernetes system namespaces.Viewing namespacesYou can list the current namespaces in a cluster using:kubectl get namespace NAME STATUS AGE default Active 1d kube-node-lease Active 1d kube-public Active 1d kube-system Active 1d Setting the namespace for a requestTo set the namespace for a current request, use the --namespace flag.For example:kubectl run nginx --image=nginx --namespace=<insert-namespace-name-here> kubectl get pods --namespace=<insert-namespace-name-here> Setting the namespace preferenceYou can permanently save the namespace for all subsequent kubectl commands in that context.kubectl config set-context --current --namespace=<insert-namespace-name-here> # Validate it kubectl config view --minify |


Question: What is Namespaces?

Answer: I n   K u b e r n e t e s ,   n a m e s p a c e s   p r o v i d e   a   m e c h a n i s m   f o r   i s o l a t i n g   g r o u p s   o f   r e s o u r c e s   w i t h i n   a   s i n g l e   c l u s t e r .   N a m e s   o f   r e s o u r c e s   n e e d   t o   b e   u n i q u e   w i t h i n   a   n a m e s p a c e ,   b u t   n o t   a c r o s s   n a m e s p a c e s .   N a m e s p a c e - b a s e d   s c o p i n g   i s   a p p l i c a b l e   o n l y   f o r   n a m e s p a c e d   o b j e c t s   ( e . g .   D e p l o y m e n t s ,   S e r v i c e s ,   e t c . )   a n d   n o t   f o r   c l u s t e r - w i d e   o b j e c t s   ( e . g .   S t o r a g e C l a s s ,   N o d e s ,   P e r s i s t e n t V o l u m e s ,   e t c . ) .


Question: What is When to Use Multiple Namespaces?

Answer: N a m e s p a c e s   a r e   i n t e n d e d   f o r   u s e   i n   e n v i r o n m e n t s   w i t h   m a n y   u s e r s   s p r e a d   a c r o s s   m u l t i p l e   t e a m s ,   o r   p r o j e c t s .   F o r   c l u s t e r s   w i t h   a   f e w   t o   t e n s   o f   u s e r s ,   y o u   s h o u l d   n o t   n e e d   t o   c r e a t e   o r   t h i n k   a b o u t   n a m e s p a c e s   a t   a l l .   S t a r t   u s i n g   n a m e s p a c e s   w h e n   y o u   n e e d   t h e   f e a t u r e s   t h e y   p r o v i d e .   N a m e s p a c e s   p r o v i d e   a   s c o p e   f o r   n a m e s .   N a m e s   o f   r e s o u r c e s   n e e d   t o   b e   u n i q u e   w i t h i n   a   n a m e s p a c e ,   b u t   n o t   a c r o s s   n a m e s p a c e s .   N a m e s p a c e s   c a n n o t   b e   n e s t e d   i n s i d e   o n e   a n o t h e r   a n d   e a c h   K u b e r n e t e s   r e s o u r c e   c a n   o n l y   b e   i n   o n e   n a m e s p a c e .   N a m e s p a c e s   a r e   a   w a y   t o   d i v i d e   c l u s t e r   r e s o u r c e s   b e t w e e n   m u l t i p l e   u s e r s   ( v i a   r e s o u r c e   q u o t a ) .   I t   i s   n o t   n e c e s s a r y   t o   u s e   m u l t i p l e   n a m e s p a c e s   t o   s e p a r a t e   s l i g h t l y   d i f f e r e n t   r e s o u r c e s ,   s u c h   a s   d i f f e r e n t   v e r s i o n s   o f   t h e   s a m e   s o f t w a r e :   u s e   l a b e l s   t o   d i s t i n g u i s h   r e s o u r c e s   w i t h i n   t h e   s a m e   n a m e s p a c e .


Question: What is Initial namespaces?

Answer: K u b e r n e t e s   s t a r t s   w i t h   f o u r   i n i t i a l   n a m e s p a c e s :


Question: What is Working with Namespaces?

Answer: C r e a t i o n   a n d   d e l e t i o n   o f   n a m e s p a c e s   a r e   d e s c r i b e d   i n   t h e   A d m i n   G u i d e   d o c u m e n t a t i o n   f o r   n a m e s p a c e s .


Question: What is Viewing namespaces?

Answer: Y o u   c a n   l i s t   t h e   c u r r e n t   n a m e s p a c e s   i n   a   c l u s t e r   u s i n g :   k u b e c t l   g e t   n a m e s p a c e   N A M E   S T A T U S   A G E   d e f a u l t   A c t i v e   1 d   k u b e - n o d e - l e a s e   A c t i v e   1 d   k u b e - p u b l i c   A c t i v e   1 d   k u b e - s y s t e m   A c t i v e   1 d


Question: What is Setting the namespace for a request?

Answer: T o   s e t   t h e   n a m e s p a c e   f o r   a   c u r r e n t   r e q u e s t ,   u s e   t h e   - - n a m e s p a c e   f l a g .   F o r   e x a m p l e :   k u b e c t l   r u n   n g i n x   - - i m a g e = n g i n x   - - n a m e s p a c e = < i n s e r t - n a m e s p a c e - n a m e - h e r e >   k u b e c t l   g e t   p o d s   - - n a m e s p a c e = < i n s e r t - n a m e s p a c e - n a m e - h e r e >


Question: What is Setting the namespace preference?

Answer: Y o u   c a n   p e r m a n e n t l y   s a v e   t h e   n a m e s p a c e   f o r   a l l   s u b s e q u e n t   k u b e c t l   c o m m a n d s   i n   t h a t   c o n t e x t .   k u b e c t l   c o n f i g   s e t - c o n t e x t   - - c u r r e n t   - - n a m e s p a c e = < i n s e r t - n a m e s p a c e - n a m e - h e r e >   #   V a l i d a t e   i t   k u b e c t l   c o n f i g   v i e w   - - m i n i f y   |   g r e p   n a m e s p a c e :


Question: What is Namespaces and DNS?

Answer: W h e n   y o u   c r e a t e   a   S e r v i c e ,   i t   c r e a t e s   a   c o r r e s p o n d i n g   D N S   e n t r y .   T h i s   e n t r y   i s   o f   t h e   f o r m   < s e r v i c e - n a m e > . < n a m e s p a c e - n a m e > . s v c . c l u s t e r . l o c a l ,   w h i c h   m e a n s   t h a t   i f   a   c o n t a i n e r   o n l y   u s e s   < s e r v i c e - n a m e > ,   i t   w i l l   r e s o l v e   t o   t h e   s e r v i c e   w h i c h   i s   l o c a l   t o   a   n a m e s p a c e .   T h i s   i s   u s e f u l   f o r   u s i n g   t h e   s a m e   c o n f i g u r a t i o n   a c r o s s   m u l t i p l e   n a m e s p a c e s   s u c h   a s   D e v e l o p m e n t ,   S t a g i n g   a n d   P r o d u c t i o n .   I f   y o u   w a n t   t o   r e a c h   a c r o s s   n a m e s p a c e s ,   y o u   n e e d   t o   u s e   t h e   f u l l y   q u a l i f i e d   d o m a i n   n a m e   ( F Q D N ) .   A s   a   r e s u l t ,   a l l   n a m e s p a c e   n a m e s   m u s t   b e   v a l i d   R F C   1 1 2 3   D N S   l a b e l s .


Question: What is Warning:?

Answer: B y   c r e a t i n g   n a m e s p a c e s   w i t h   t h e   s a m e   n a m e   a s   p u b l i c   t o p - l e v e l   d o m a i n s ,   S e r v i c e s   i n   t h e s e   n a m e s p a c e s   c a n   h a v e   s h o r t   D N S   n a m e s   t h a t   o v e r l a p   w i t h   p u b l i c   D N S   r e c o r d s .   W o r k l o a d s   f r o m   a n y   n a m e s p a c e   p e r f o r m i n g   a   D N S   l o o k u p   w i t h o u t   a   t r a i l i n g   d o t   w i l l   b e   r e d i r e c t e d   t o   t h o s e   s e r v i c e s ,   t a k i n g   p r e c e d e n c e   o v e r   p u b l i c   D N S .   T o   m i t i g a t e   t h i s ,   l i m i t   p r i v i l e g e s   f o r   c r e a t i n g   n a m e s p a c e s   t o   t r u s t e d   u s e r s .   I f   r e q u i r e d ,   y o u   c o u l d   a d d i t i o n a l l y   c o n f i g u r e   t h i r d - p a r t y   s e c u r i t y   c o n t r o l s ,   s u c h   a s   a d m i s s i o n   w e b h o o k s ,   t o   b l o c k   c r e a t i n g   a n y   n a m e s p a c e   w i t h   t h e   n a m e   o f   p u b l i c   T L D s .


Question: What is Not all objects are in a namespace?

Answer: M o s t   K u b e r n e t e s   r e s o u r c e s   ( e . g .   p o d s ,   s e r v i c e s ,   r e p l i c a t i o n   c o n t r o l l e r s ,   a n d   o t h e r s )   a r e   i n   s o m e   n a m e s p a c e s .   H o w e v e r   n a m e s p a c e   r e s o u r c e s   a r e   n o t   t h e m s e l v e s   i n   a   n a m e s p a c e .   A n d   l o w - l e v e l   r e s o u r c e s ,   s u c h   a s   n o d e s   a n d   p e r s i s t e n t V o l u m e s ,   a r e   n o t   i n   a n y   n a m e s p a c e .   T o   s e e   w h i c h   K u b e r n e t e s   r e s o u r c e s   a r e   a n d   a r e n ' t   i n   a   n a m e s p a c e :   #   I n   a   n a m e s p a c e   k u b e c t l   a p i - r e s o u r c e s   - - n a m e s p a c e d = t r u e   #   N o t   i n   a   n a m e s p a c e   k u b e c t l   a p i - r e s o u r c e s   - - n a m e s p a c e d = f a l s e


Question: What is Automatic labelling?

Answer: T h e   K u b e r n e t e s   c o n t r o l   p l a n e   s e t s   a n   i m m u t a b l e   l a b e l   k u b e r n e t e s . i o / m e t a d a t a . n a m e   o n   a l l   n a m e s p a c e s .   T h e   v a l u e   o f   t h e   l a b e l   i s   t h e   n a m e s p a c e   n a m e .


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   c r e a t i n g   a   n e w   n a m e s p a c e . L e a r n   m o r e   a b o u t   d e l e t i n g   a   n a m e s p a c e .


Question: What is Application Security Checklist?

Answer: Application Security ChecklistBaseline guidelines around ensuring application security on Kubernetes, aimed at application developersThis checklist aims to provide basic guidelines on securing applications running in Kubernetes from a developer's perspective. This list is not meant to be exhaustive and is intended to evolve over time.On how to read and use this document:The order of topics does not reflect an order of priority.Some checklist items are detailed in the paragraph below the list of each section.This checklist assumes that a developer is a Kubernetes cluster user who interacts with namespaced scope objects.Caution:Checklists are not sufficient for attaining a good security posture on their own. A good security posture requires constant attention and improvement, but a checklist can be the first step on the never-ending journey towards security preparedness. Some recommendations in this checklist may be too restrictive or too lax for your specific security needs. Since Kubernetes security is not "one size fits all", each category of checklist items should be evaluated on its merits.Base security hardeningThe following checklist provides base security hardening recommendations that would apply to most applications deploying to Kubernetes.Application design Follow the right security principles when designing applications. Application configured with appropriate QoS class through resource request and limits. Memory limit is set for the workloads with a limit equal to or greater than the request. CPU limit might be set on sensitive workloads.Service account Avoid using the default ServiceAccount. Instead, create ServiceAccounts for each workload or microservice. automountServiceAccountToken should be set to false unless the pod specifically requires access to the Kubernetes API to operate.Pod-level securityContext recommendations Set runAsNonRoot: true. Configure the container to execute as a less privileged user (for example, using runAsUser and runAsGroup), and configure appropriate permissions on files or directories inside the container image. Optionally add a supplementary group with fsGroup to access persistent volumes. The application deploys into a namespace that enforces an appropriate Pod security standard. If you cannot control this enforcement for the cluster(s) where the application is deployed, take this into account either through documentation or additional defense in depth.Container-level securityContext recommendations Disable privilege escalations using allowPrivilegeEscalation: false. Configure the root filesystem to be read-only with readOnlyRootFilesystem: true. Avoid running privileged containers (set privileged: false). Drop all capabilities from the containers and add back only specific ones that are needed for operation of the container.Role Based Access Control (RBAC) Permissions such as create, patch, update and delete should be only granted if necessary. Avoid creating RBAC permissions to create or update roles


Question: How does Application Security Checklist work?

Answer: Application Security ChecklistBaseline guidelines around ensuring application security on Kubernetes, aimed at application developersThis checklist aims to provide basic guidelines on securing applications running in Kubernetes from a developer's perspective. This list is not meant to be exhaustive and is intended to evolve over time.On how to read and use this document:The order of topics does not reflect an order of priority.Some checklist items are detailed in the paragraph below the list of each section.This checklist assumes that a developer is a Kubernetes cluster user who interacts with namespaced scope objects.Caution:Checklists are not sufficient for attaining a good security posture on their own. A good security posture requires constant attention and improvement, but a checklist can be the first step on the never-ending journey towards security preparedness. Some recommendations in this checklist may be too restrictive or too lax for your specific security needs. Since Kubernetes security is not "one size fits all", each category of checklist items should be evaluated on its merits.Base security hardeningThe following checklist provides base security hardening recommendations that would apply to most applications deploying to Kubernetes.Application design Follow the right security principles when designing applications. Application configured with appropriate QoS class through resource request and limits. Memory limit is set for the workloads with a limit equal to or greater than the request. CPU limit might be set on sensitive workloads.Service account Avoid using the default ServiceAccount. Instead, create ServiceAccounts for each workload or microservice. automountServiceAccountToken should be set to false unless the pod specifically requires access to the Kubernetes API to operate.Pod-level securityContext recommendations Set runAsNonRoot: true. Configure the container to execute as a less privileged user (for example, using runAsUser and runAsGroup), and configure appropriate permissions on files or directories inside the container image. Optionally add a supplementary group with fsGroup to access persistent volumes. The application deploys into a namespace that enforces an appropriate Pod security standard. If you cannot control this enforcement for the cluster(s) where the application is deployed, take this into account either through documentation or additional defense in depth.Container-level securityContext recommendations Disable privilege escalations using allowPrivilegeEscalation: false. Configure the root filesystem to be read-only with readOnlyRootFilesystem: true. Avoid running privileged containers (set privileged: false). Drop all capabilities from the containers and add back only specific ones that are needed for operation of the container.Role Based Access Control (RBAC) Permissions such as create, patch, update and delete should be only granted if necessary. Avoid creating RBAC permissions to create or update roles


Question: When would you use Application Security Checklist?

Answer: Application Security ChecklistBaseline guidelines around ensuring application security on Kubernetes, aimed at application developersThis checklist aims to provide basic guidelines on securing applications running in Kubernetes from a developer's perspective. This list is not meant to be exhaustive and is intended to evolve over time.On how to read and use this document:The order of topics does not reflect an order of priority.Some checklist items are detailed in the paragraph below the list of each section.This checklist assumes that a developer is a Kubernetes cluster user who interacts with namespaced scope objects.Caution:Checklists are not sufficient for attaining a good security posture on their own. A good security posture requires constant attention and improvement, but a checklist can be the first step on the never-ending journey towards security preparedness. Some recommendations in this checklist may be too restrictive or too lax for your specific security needs. Since Kubernetes security is not "one size fits all", each category of checklist items should be evaluated on its merits.Base security hardeningThe following checklist provides base security hardening recommendations that would apply to most applications deploying to Kubernetes.Application design Follow the right security principles when designing applications. Application configured with appropriate QoS class through resource request and limits. Memory limit is set for the workloads with a limit equal to or greater than the request. CPU limit might be set on sensitive workloads.Service account Avoid using the default ServiceAccount. Instead, create ServiceAccounts for each workload or microservice. automountServiceAccountToken should be set to false unless the pod specifically requires access to the Kubernetes API to operate.Pod-level securityContext recommendations Set runAsNonRoot: true. Configure the container to execute as a less privileged user (for example, using runAsUser and runAsGroup), and configure appropriate permissions on files or directories inside the container image. Optionally add a supplementary group with fsGroup to access persistent volumes. The application deploys into a namespace that enforces an appropriate Pod security standard. If you cannot control this enforcement for the cluster(s) where the application is deployed, take this into account either through documentation or additional defense in depth.Container-level securityContext recommendations Disable privilege escalations using allowPrivilegeEscalation: false. Configure the root filesystem to be read-only with readOnlyRootFilesystem: true. Avoid running privileged containers (set privileged: false). Drop all capabilities from the containers and add back only specific ones that are needed for operation of the container.Role Based Access Control (RBAC) Permissions such as create, patch, update and delete should be only granted if necessary. Avoid creating RBAC permissions to create or update roles


Question: What are the benefits of Application Security Checklist?

Answer: Application Security ChecklistBaseline guidelines around ensuring application security on Kubernetes, aimed at application developersThis checklist aims to provide basic guidelines on securing applications running in Kubernetes from a developer's perspective. This list is not meant to be exhaustive and is intended to evolve over time.On how to read and use this document:The order of topics does not reflect an order of priority.Some checklist items are detailed in the paragraph below the list of each section.This checklist assumes that a developer is a Kubernetes cluster user who interacts with namespaced scope objects.Caution:Checklists are not sufficient for attaining a good security posture on their own. A good security posture requires constant attention and improvement, but a checklist can be the first step on the never-ending journey towards security preparedness. Some recommendations in this checklist may be too restrictive or too lax for your specific security needs. Since Kubernetes security is not "one size fits all", each category of checklist items should be evaluated on its merits.Base security hardeningThe following checklist provides base security hardening recommendations that would apply to most applications deploying to Kubernetes.Application design Follow the right security principles when designing applications. Application configured with appropriate QoS class through resource request and limits. Memory limit is set for the workloads with a limit equal to or greater than the request. CPU limit might be set on sensitive workloads.Service account Avoid using the default ServiceAccount. Instead, create ServiceAccounts for each workload or microservice. automountServiceAccountToken should be set to false unless the pod specifically requires access to the Kubernetes API to operate.Pod-level securityContext recommendations Set runAsNonRoot: true. Configure the container to execute as a less privileged user (for example, using runAsUser and runAsGroup), and configure appropriate permissions on files or directories inside the container image. Optionally add a supplementary group with fsGroup to access persistent volumes. The application deploys into a namespace that enforces an appropriate Pod security standard. If you cannot control this enforcement for the cluster(s) where the application is deployed, take this into account either through documentation or additional defense in depth.Container-level securityContext recommendations Disable privilege escalations using allowPrivilegeEscalation: false. Configure the root filesystem to be read-only with readOnlyRootFilesystem: true. Avoid running privileged containers (set privileged: false). Drop all capabilities from the containers and add back only specific ones that are needed for operation of the container.Role Based Access Control (RBAC) Permissions such as create, patch, update and delete should be only granted if necessary. Avoid creating RBAC permissions to create or update roles


Question: What is Application Security Checklist?

Answer: T h i s   c h e c k l i s t   a i m s   t o   p r o v i d e   b a s i c   g u i d e l i n e s   o n   s e c u r i n g   a p p l i c a t i o n s   r u n n i n g   i n   K u b e r n e t e s   f r o m   a   d e v e l o p e r ' s   p e r s p e c t i v e .   T h i s   l i s t   i s   n o t   m e a n t   t o   b e   e x h a u s t i v e   a n d   i s   i n t e n d e d   t o   e v o l v e   o v e r   t i m e .   O n   h o w   t o   r e a d   a n d   u s e   t h i s   d o c u m e n t :   T h e   o r d e r   o f   t o p i c s   d o e s   n o t   r e f l e c t   a n   o r d e r   o f   p r i o r i t y . S o m e   c h e c k l i s t   i t e m s   a r e   d e t a i l e d   i n   t h e   p a r a g r a p h   b e l o w   t h e   l i s t   o f   e a c h   s e c t i o n . T h i s   c h e c k l i s t   a s s u m e s   t h a t   a   d e v e l o p e r   i s   a   K u b e r n e t e s   c l u s t e r   u s e r   w h o   i n t e r a c t s   w i t h   n a m e s p a c e d   s c o p e   o b j e c t s .


Question: What is Base security hardening?

Answer: T h e   f o l l o w i n g   c h e c k l i s t   p r o v i d e s   b a s e   s e c u r i t y   h a r d e n i n g   r e c o m m e n d a t i o n s   t h a t   w o u l d   a p p l y   t o   m o s t   a p p l i c a t i o n s   d e p l o y i n g   t o   K u b e r n e t e s .


Question: What is Application design?

Answer: F o l l o w   t h e   r i g h t   s e c u r i t y   p r i n c i p l e s   w h e n   d e s i g n i n g   a p p l i c a t i o n s .   A p p l i c a t i o n   c o n f i g u r e d   w i t h   a p p r o p r i a t e   Q o S   c l a s s   t h r o u g h   r e s o u r c e   r e q u e s t   a n d   l i m i t s .   M e m o r y   l i m i t   i s   s e t   f o r   t h e   w o r k l o a d s   w i t h   a   l i m i t   e q u a l   t o   o r   g r e a t e r   t h a n   t h e   r e q u e s t .   C P U   l i m i t   m i g h t   b e   s e t   o n   s e n s i t i v e   w o r k l o a d s .   M e m o r y   l i m i t   i s   s e t   f o r   t h e   w o r k l o a d s   w i t h   a   l i m i t   e q u a l   t o   o r   g r e a t e r   t h a n   t h e   r e q u e s t .   C P U   l i m i t   m i g h t   b e   s e t   o n   s e n s i t i v e   w o r k l o a d s .


Question: What is Service account?

Answer: A v o i d   u s i n g   t h e   d e f a u l t   S e r v i c e A c c o u n t .   I n s t e a d ,   c r e a t e   S e r v i c e A c c o u n t s   f o r   e a c h   w o r k l o a d   o r   m i c r o s e r v i c e .   a u t o m o u n t S e r v i c e A c c o u n t T o k e n   s h o u l d   b e   s e t   t o   f a l s e   u n l e s s   t h e   p o d   s p e c i f i c a l l y   r e q u i r e s   a c c e s s   t o   t h e   K u b e r n e t e s   A P I   t o   o p e r a t e .


Question: What is Pod-level securityContext recommendations?

Answer: S e t   r u n A s N o n R o o t :   t r u e .   C o n f i g u r e   t h e   c o n t a i n e r   t o   e x e c u t e   a s   a   l e s s   p r i v i l e g e d   u s e r   ( f o r   e x a m p l e ,   u s i n g   r u n A s U s e r   a n d   r u n A s G r o u p ) ,   a n d   c o n f i g u r e   a p p r o p r i a t e   p e r m i s s i o n s   o n   f i l e s   o r   d i r e c t o r i e s   i n s i d e   t h e   c o n t a i n e r   i m a g e .   O p t i o n a l l y   a d d   a   s u p p l e m e n t a r y   g r o u p   w i t h   f s G r o u p   t o   a c c e s s   p e r s i s t e n t   v o l u m e s .   T h e   a p p l i c a t i o n   d e p l o y s   i n t o   a   n a m e s p a c e   t h a t   e n f o r c e s   a n   a p p r o p r i a t e   P o d   s e c u r i t y   s t a n d a r d .   I f   y o u   c a n n o t   c o n t r o l   t h i s   e n f o r c e m e n t   f o r   t h e   c l u s t e r ( s )   w h e r e   t h e   a p p l i c a t i o n   i s   d e p l o y e d ,   t a k e   t h i s   i n t o   a c c o u n t   e i t h e r   t h r o u g h   d o c u m e n t a t i o n   o r   a d d i t i o n a l   d e f e n s e   i n   d e p t h .


Question: What is Container-level securityContext recommendations?

Answer: D i s a b l e   p r i v i l e g e   e s c a l a t i o n s   u s i n g   a l l o w P r i v i l e g e E s c a l a t i o n :   f a l s e .   C o n f i g u r e   t h e   r o o t   f i l e s y s t e m   t o   b e   r e a d - o n l y   w i t h   r e a d O n l y R o o t F i l e s y s t e m :   t r u e .   A v o i d   r u n n i n g   p r i v i l e g e d   c o n t a i n e r s   ( s e t   p r i v i l e g e d :   f a l s e ) .   D r o p   a l l   c a p a b i l i t i e s   f r o m   t h e   c o n t a i n e r s   a n d   a d d   b a c k   o n l y   s p e c i f i c   o n e s   t h a t   a r e   n e e d e d   f o r   o p e r a t i o n   o f   t h e   c o n t a i n e r .


Question: What is Role Based Access Control (RBAC)?

Answer: P e r m i s s i o n s   s u c h   a s   c r e a t e ,   p a t c h ,   u p d a t e   a n d   d e l e t e   s h o u l d   b e   o n l y   g r a n t e d   i f   n e c e s s a r y .   A v o i d   c r e a t i n g   R B A C   p e r m i s s i o n s   t o   c r e a t e   o r   u p d a t e   r o l e s   w h i c h   c a n   l e a d   t o   p r i v i l e g e   e s c a l a t i o n .   R e v i e w   b i n d i n g s   f o r   t h e   s y s t e m : u n a u t h e n t i c a t e d   g r o u p   a n d   r e m o v e   t h e m   w h e r e   p o s s i b l e ,   a s   t h i s   g i v e s   a c c e s s   t o   a n y o n e   w h o   c a n   c o n t a c t   t h e   A P I   s e r v e r   a t   a   n e t w o r k   l e v e l .   T h e   c r e a t e ,   u p d a t e   a n d   d e l e t e   v e r b s   s h o u l d   b e   p e r m i t t e d   j u d i c i o u s l y .   T h e   p a t c h   v e r b   i f   a l l o w e d   o n   a   N a m e s p a c e   c a n   a l l o w   u s e r s   t o   u p d a t e   l a b e l s   o n   t h e   n a m e s p a c e   o r   d e p l o y m e n t s   w h i c h   c a n   i n c r e a s e   t h e   a t t a c k   s u r f a c e .   F o r   s e n s i t i v e   w o r k l o a d s ,   c o n s i d e r   p r o v i d i n g   a   r e c o m m e n d e d   V a l i d a t i n g A d m i s s i o n P o l i c y   t h a t   f u r t h e r   r e s t r i c t s   t h e   p e r m i t t e d   w r i t e   a c t i o n s .


Question: What is Image security?

Answer: U s i n g   a n   i m a g e   s c a n n i n g   t o o l   t o   s c a n   a n   i m a g e   b e f o r e   d e p l o y i n g   c o n t a i n e r s   i n   t h e   K u b e r n e t e s   c l u s t e r .   U s e   c o n t a i n e r   s i g n i n g   t o   v a l i d a t e   t h e   c o n t a i n e r   i m a g e   s i g n a t u r e   b e f o r e   d e p l o y i n g   t o   t h e   K u b e r n e t e s   c l u s t e r .


Question: What is Network policies?

Answer: C o n f i g u r e   N e t w o r k P o l i c i e s   t o   o n l y   a l l o w   e x p e c t e d   i n g r e s s   a n d   e g r e s s   t r a f f i c   f r o m   t h e   p o d s .   M a k e   s u r e   t h a t   y o u r   c l u s t e r   p r o v i d e s   a n d   e n f o r c e s   N e t w o r k P o l i c y .   I f   y o u   a r e   w r i t i n g   a n   a p p l i c a t i o n   t h a t   u s e r s   w i l l   d e p l o y   t o   d i f f e r e n t   c l u s t e r s ,   c o n s i d e r   w h e t h e r   y o u   c a n   a s s u m e   t h a t   N e t w o r k P o l i c y   i s   a v a i l a b l e   a n d   e n f o r c e d .


Question: What is Advanced security hardening?

Answer: T h i s   s e c t i o n   o f   t h i s   g u i d e   c o v e r s   s o m e   a d v a n c e d   s e c u r i t y   h a r d e n i n g   p o i n t s   w h i c h   m i g h t   b e   v a l u a b l e   b a s e d   o n   d i f f e r e n t   K u b e r n e t e s   e n v i r o n m e n t   s e t u p .


Question: What is Linux container security?

Answer: C o n f i g u r e   S e c u r i t y   C o n t e x t   f o r   t h e   p o d - c o n t a i n e r .   S e t   t h e   S e c c o m p   P r o f i l e   f o r   a   C o n t a i n e r .   R e s t r i c t   a   C o n t a i n e r ' s   A c c e s s   t o   R e s o u r c e s   w i t h   A p p A r m o r .   A s s i g n   S E L i n u x   L a b e l s   t o   a   C o n t a i n e r .


Question: What is Runtime classes?

Answer: C o n f i g u r e   a p p r o p r i a t e   r u n t i m e   c l a s s e s   f o r   c o n t a i n e r s .   S o m e   c o n t a i n e r s   m a y   r e q u i r e   a   d i f f e r e n t   i s o l a t i o n   l e v e l   f r o m   w h a t   i s   p r o v i d e d   b y   t h e   d e f a u l t   r u n t i m e   o f   t h e   c l u s t e r .   r u n t i m e C l a s s N a m e   c a n   b e   u s e d   i n   a   p o d s p e c   t o   d e f i n e   a   d i f f e r e n t   r u n t i m e   c l a s s .   F o r   s e n s i t i v e   w o r k l o a d s   c o n s i d e r   u s i n g   k e r n e l   e m u l a t i o n   t o o l s   l i k e   g V i s o r ,   o r   v i r t u a l i z e d   i s o l a t i o n   u s i n g   a   m e c h a n i s m   s u c h   a s   k a t a - c o n t a i n e r s .   I n   h i g h   t r u s t   e n v i r o n m e n t s ,   c o n s i d e r   u s i n g   c o n f i d e n t i a l   v i r t u a l   m a c h i n e s   t o   i m p r o v e   c l u s t e r   s e c u r i t y   e v e n   f u r t h e r .   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Monitoring, Logging, and Debugging?

Answer: Monitoring, Logging, and DebuggingSet up monitoring and logging to troubleshoot a cluster, or debug a containerized application.Sometimes things go wrong. This guide helps you gather the relevant information and resolve issues. It has four sections:Debugging your application - Useful for users who are deploying code into Kubernetes and wondering why it is not working.Debugging your cluster - Useful for cluster administrators and operators troubleshooting issues with the Kubernetes cluster itself.Logging in Kubernetes - Useful for cluster administrators who want to set up and manage logging in Kubernetes.Monitoring in Kubernetes - Useful for cluster administrators who want to enable monitoring in a Kubernetes cluster.You should also check the known issues for the release you're using.Getting helpIf your problem isn't answered by any of the guides above, there are variety of ways for you to get help from the Kubernetes community.QuestionsThe documentation on this site has been structured to provide answers to a wide range of questions. Concepts explain the Kubernetes architecture and how each component works, while Setup provides practical instructions for getting started. Tasks show how to accomplish commonly used tasks, and Tutorials are more comprehensive walkthroughs of real-world, industry-specific, or end-to-end development scenarios. The Reference section provides detailed documentation on the Kubernetes API and command-line interfaces (CLIs), such as kubectl.Help! My question isn't covered! I need help now!Stack Exchange, Stack Overflow, or Server FaultIf you have questions related to software development for your containerized app, you can ask those on Stack Overflow.If you have Kubernetes questions related to cluster management or configuration, you can ask those on Server Fault.There are also several more specific Stack Exchange network sites which might be the right place to ask Kubernetes questions in areas such as DevOps, Software Engineering, or InfoSec.Someone else from the community may have already asked a similar question or may be able to help with your problem.The Kubernetes team will also monitor posts tagged Kubernetes. If there aren't any existing questions that help, please ensure that your question is on-topic on Stack Overflow, Server Fault, or the Stack Exchange Network site you're asking on, and read through the guidance on how to ask a new question, before asking a new one!SlackMany people from the Kubernetes community hang out on Kubernetes Slack in the #kubernetes-users channel. Slack requires registration; you can request an invitation, and registration is open to everyone). Feel free to come and ask any and all questions. Once registered, access the Kubernetes organisation in Slack via your web browser or via Slack's own dedicated app.Once you are registered, browse the growing list of channels for various subjects of interest. For example, people new to Kubernetes may also want to join the #kubernetes-novice chann


Question: How does Monitoring, Logging, and Debugging work?

Answer: Monitoring, Logging, and DebuggingSet up monitoring and logging to troubleshoot a cluster, or debug a containerized application.Sometimes things go wrong. This guide helps you gather the relevant information and resolve issues. It has four sections:Debugging your application - Useful for users who are deploying code into Kubernetes and wondering why it is not working.Debugging your cluster - Useful for cluster administrators and operators troubleshooting issues with the Kubernetes cluster itself.Logging in Kubernetes - Useful for cluster administrators who want to set up and manage logging in Kubernetes.Monitoring in Kubernetes - Useful for cluster administrators who want to enable monitoring in a Kubernetes cluster.You should also check the known issues for the release you're using.Getting helpIf your problem isn't answered by any of the guides above, there are variety of ways for you to get help from the Kubernetes community.QuestionsThe documentation on this site has been structured to provide answers to a wide range of questions. Concepts explain the Kubernetes architecture and how each component works, while Setup provides practical instructions for getting started. Tasks show how to accomplish commonly used tasks, and Tutorials are more comprehensive walkthroughs of real-world, industry-specific, or end-to-end development scenarios. The Reference section provides detailed documentation on the Kubernetes API and command-line interfaces (CLIs), such as kubectl.Help! My question isn't covered! I need help now!Stack Exchange, Stack Overflow, or Server FaultIf you have questions related to software development for your containerized app, you can ask those on Stack Overflow.If you have Kubernetes questions related to cluster management or configuration, you can ask those on Server Fault.There are also several more specific Stack Exchange network sites which might be the right place to ask Kubernetes questions in areas such as DevOps, Software Engineering, or InfoSec.Someone else from the community may have already asked a similar question or may be able to help with your problem.The Kubernetes team will also monitor posts tagged Kubernetes. If there aren't any existing questions that help, please ensure that your question is on-topic on Stack Overflow, Server Fault, or the Stack Exchange Network site you're asking on, and read through the guidance on how to ask a new question, before asking a new one!SlackMany people from the Kubernetes community hang out on Kubernetes Slack in the #kubernetes-users channel. Slack requires registration; you can request an invitation, and registration is open to everyone). Feel free to come and ask any and all questions. Once registered, access the Kubernetes organisation in Slack via your web browser or via Slack's own dedicated app.Once you are registered, browse the growing list of channels for various subjects of interest. For example, people new to Kubernetes may also want to join the #kubernetes-novice chann


Question: When would you use Monitoring, Logging, and Debugging?

Answer: Monitoring, Logging, and DebuggingSet up monitoring and logging to troubleshoot a cluster, or debug a containerized application.Sometimes things go wrong. This guide helps you gather the relevant information and resolve issues. It has four sections:Debugging your application - Useful for users who are deploying code into Kubernetes and wondering why it is not working.Debugging your cluster - Useful for cluster administrators and operators troubleshooting issues with the Kubernetes cluster itself.Logging in Kubernetes - Useful for cluster administrators who want to set up and manage logging in Kubernetes.Monitoring in Kubernetes - Useful for cluster administrators who want to enable monitoring in a Kubernetes cluster.You should also check the known issues for the release you're using.Getting helpIf your problem isn't answered by any of the guides above, there are variety of ways for you to get help from the Kubernetes community.QuestionsThe documentation on this site has been structured to provide answers to a wide range of questions. Concepts explain the Kubernetes architecture and how each component works, while Setup provides practical instructions for getting started. Tasks show how to accomplish commonly used tasks, and Tutorials are more comprehensive walkthroughs of real-world, industry-specific, or end-to-end development scenarios. The Reference section provides detailed documentation on the Kubernetes API and command-line interfaces (CLIs), such as kubectl.Help! My question isn't covered! I need help now!Stack Exchange, Stack Overflow, or Server FaultIf you have questions related to software development for your containerized app, you can ask those on Stack Overflow.If you have Kubernetes questions related to cluster management or configuration, you can ask those on Server Fault.There are also several more specific Stack Exchange network sites which might be the right place to ask Kubernetes questions in areas such as DevOps, Software Engineering, or InfoSec.Someone else from the community may have already asked a similar question or may be able to help with your problem.The Kubernetes team will also monitor posts tagged Kubernetes. If there aren't any existing questions that help, please ensure that your question is on-topic on Stack Overflow, Server Fault, or the Stack Exchange Network site you're asking on, and read through the guidance on how to ask a new question, before asking a new one!SlackMany people from the Kubernetes community hang out on Kubernetes Slack in the #kubernetes-users channel. Slack requires registration; you can request an invitation, and registration is open to everyone). Feel free to come and ask any and all questions. Once registered, access the Kubernetes organisation in Slack via your web browser or via Slack's own dedicated app.Once you are registered, browse the growing list of channels for various subjects of interest. For example, people new to Kubernetes may also want to join the #kubernetes-novice chann


Question: What are the benefits of Monitoring, Logging, and Debugging?

Answer: Monitoring, Logging, and DebuggingSet up monitoring and logging to troubleshoot a cluster, or debug a containerized application.Sometimes things go wrong. This guide helps you gather the relevant information and resolve issues. It has four sections:Debugging your application - Useful for users who are deploying code into Kubernetes and wondering why it is not working.Debugging your cluster - Useful for cluster administrators and operators troubleshooting issues with the Kubernetes cluster itself.Logging in Kubernetes - Useful for cluster administrators who want to set up and manage logging in Kubernetes.Monitoring in Kubernetes - Useful for cluster administrators who want to enable monitoring in a Kubernetes cluster.You should also check the known issues for the release you're using.Getting helpIf your problem isn't answered by any of the guides above, there are variety of ways for you to get help from the Kubernetes community.QuestionsThe documentation on this site has been structured to provide answers to a wide range of questions. Concepts explain the Kubernetes architecture and how each component works, while Setup provides practical instructions for getting started. Tasks show how to accomplish commonly used tasks, and Tutorials are more comprehensive walkthroughs of real-world, industry-specific, or end-to-end development scenarios. The Reference section provides detailed documentation on the Kubernetes API and command-line interfaces (CLIs), such as kubectl.Help! My question isn't covered! I need help now!Stack Exchange, Stack Overflow, or Server FaultIf you have questions related to software development for your containerized app, you can ask those on Stack Overflow.If you have Kubernetes questions related to cluster management or configuration, you can ask those on Server Fault.There are also several more specific Stack Exchange network sites which might be the right place to ask Kubernetes questions in areas such as DevOps, Software Engineering, or InfoSec.Someone else from the community may have already asked a similar question or may be able to help with your problem.The Kubernetes team will also monitor posts tagged Kubernetes. If there aren't any existing questions that help, please ensure that your question is on-topic on Stack Overflow, Server Fault, or the Stack Exchange Network site you're asking on, and read through the guidance on how to ask a new question, before asking a new one!SlackMany people from the Kubernetes community hang out on Kubernetes Slack in the #kubernetes-users channel. Slack requires registration; you can request an invitation, and registration is open to everyone). Feel free to come and ask any and all questions. Once registered, access the Kubernetes organisation in Slack via your web browser or via Slack's own dedicated app.Once you are registered, browse the growing list of channels for various subjects of interest. For example, people new to Kubernetes may also want to join the #kubernetes-novice chann


Question: What is Monitoring, Logging, and Debugging?

Answer: S o m e t i m e s   t h i n g s   g o   w r o n g .   T h i s   g u i d e   h e l p s   y o u   g a t h e r   t h e   r e l e v a n t   i n f o r m a t i o n   a n d   r e s o l v e   i s s u e s .   I t   h a s   f o u r   s e c t i o n s :   D e b u g g i n g   y o u r   a p p l i c a t i o n   -   U s e f u l   f o r   u s e r s   w h o   a r e   d e p l o y i n g   c o d e   i n t o   K u b e r n e t e s   a n d   w o n d e r i n g   w h y   i t   i s   n o t   w o r k i n g . D e b u g g i n g   y o u r   c l u s t e r   -   U s e f u l   f o r   c l u s t e r   a d m i n i s t r a t o r s   a n d   o p e r a t o r s   t r o u b l e s h o o t i n g   i s s u e s   w i t h   t h e   K u b e r n e t e s   c l u s t e r   i t s e l f . L o g g i n g   i n   K u b e r n e t e s   -   U s e f u l   f o r   c l u s t e r   a d m i n i s t r a t o r s   w h o   w a n t   t o   s e t   u p   a n d   m a n a g e   l o g g i n g   i n   K u b e r n e t e s . M o n i t o r i n g   i n   K u b e r n e t e s   -   U s e f u l   f o r   c l u s t e r   a d m i n i s t r a t o r s   w h o   w a n t   t o   e n a b l e   m o n i t o r i n g   i n   a   K u b e r n e t e s   c l u s t e r .   Y o u   s h o u l d   a l s o   c h e c k   t h e   k n o w n   i s s u e s   f o r   t h e   r e l e a s e   y o u ' r e   u s i n g .


Question: What is Getting help?

Answer: I f   y o u r   p r o b l e m   i s n ' t   a n s w e r e d   b y   a n y   o f   t h e   g u i d e s   a b o v e ,   t h e r e   a r e   v a r i e t y   o f   w a y s   f o r   y o u   t o   g e t   h e l p   f r o m   t h e   K u b e r n e t e s   c o m m u n i t y .


Question: What is Questions?

Answer: T h e   d o c u m e n t a t i o n   o n   t h i s   s i t e   h a s   b e e n   s t r u c t u r e d   t o   p r o v i d e   a n s w e r s   t o   a   w i d e   r a n g e   o f   q u e s t i o n s .   C o n c e p t s   e x p l a i n   t h e   K u b e r n e t e s   a r c h i t e c t u r e   a n d   h o w   e a c h   c o m p o n e n t   w o r k s ,   w h i l e   S e t u p   p r o v i d e s   p r a c t i c a l   i n s t r u c t i o n s   f o r   g e t t i n g   s t a r t e d .   T a s k s   s h o w   h o w   t o   a c c o m p l i s h   c o m m o n l y   u s e d   t a s k s ,   a n d   T u t o r i a l s   a r e   m o r e   c o m p r e h e n s i v e   w a l k t h r o u g h s   o f   r e a l - w o r l d ,   i n d u s t r y - s p e c i f i c ,   o r   e n d - t o - e n d   d e v e l o p m e n t   s c e n a r i o s .   T h e   R e f e r e n c e   s e c t i o n   p r o v i d e s   d e t a i l e d   d o c u m e n t a t i o n   o n   t h e   K u b e r n e t e s   A P I   a n d   c o m m a n d - l i n e   i n t e r f a c e s   ( C L I s ) ,   s u c h   a s   k u b e c t l .


Question: What is Stack Exchange, Stack Overflow, or Server Fault?

Answer: I f   y o u   h a v e   q u e s t i o n s   r e l a t e d   t o   s o f t w a r e   d e v e l o p m e n t   f o r   y o u r   c o n t a i n e r i z e d   a p p ,   y o u   c a n   a s k   t h o s e   o n   S t a c k   O v e r f l o w .   I f   y o u   h a v e   K u b e r n e t e s   q u e s t i o n s   r e l a t e d   t o   c l u s t e r   m a n a g e m e n t   o r   c o n f i g u r a t i o n ,   y o u   c a n   a s k   t h o s e   o n   S e r v e r   F a u l t .   T h e r e   a r e   a l s o   s e v e r a l   m o r e   s p e c i f i c   S t a c k   E x c h a n g e   n e t w o r k   s i t e s   w h i c h   m i g h t   b e   t h e   r i g h t   p l a c e   t o   a s k   K u b e r n e t e s   q u e s t i o n s   i n   a r e a s   s u c h   a s   D e v O p s ,   S o f t w a r e   E n g i n e e r i n g ,   o r   I n f o S e c .   S o m e o n e   e l s e   f r o m   t h e   c o m m u n i t y   m a y   h a v e   a l r e a d y   a s k e d   a   s i m i l a r   q u e s t i o n   o r   m a y   b e   a b l e   t o   h e l p   w i t h   y o u r   p r o b l e m .   T h e   K u b e r n e t e s   t e a m   w i l l   a l s o   m o n i t o r   p o s t s   t a g g e d   K u b e r n e t e s .   I f   t h e r e   a r e n ' t   a n y   e x i s t i n g   q u e s t i o n s   t h a t   h e l p ,   p l e a s e   e n s u r e   t h a t   y o u r   q u e s t i o n   i s   o n - t o p i c   o n   S t a c k   O v e r f l o w ,   S e r v e r   F a u l t ,   o r   t h e   S t a c k   E x c h a n g e   N e t w o r k   s i t e   y o u ' r e   a s k i n g   o n ,   a n d   r e a d   t h r o u g h   t h e   g u i d a n c e   o n   h o w   t o   a s k   a   n e w   q u e s t i o n ,   b e f o r e   a s k i n g   a   n e w   o n e !


Question: What is Slack?

Answer: M a n y   p e o p l e   f r o m   t h e   K u b e r n e t e s   c o m m u n i t y   h a n g   o u t   o n   K u b e r n e t e s   S l a c k   i n   t h e   # k u b e r n e t e s - u s e r s   c h a n n e l .   S l a c k   r e q u i r e s   r e g i s t r a t i o n ;   y o u   c a n   r e q u e s t   a n   i n v i t a t i o n ,   a n d   r e g i s t r a t i o n   i s   o p e n   t o   e v e r y o n e ) .   F e e l   f r e e   t o   c o m e   a n d   a s k   a n y   a n d   a l l   q u e s t i o n s .   O n c e   r e g i s t e r e d ,   a c c e s s   t h e   K u b e r n e t e s   o r g a n i s a t i o n   i n   S l a c k   v i a   y o u r   w e b   b r o w s e r   o r   v i a   S l a c k ' s   o w n   d e d i c a t e d   a p p .   O n c e   y o u   a r e   r e g i s t e r e d ,   b r o w s e   t h e   g r o w i n g   l i s t   o f   c h a n n e l s   f o r   v a r i o u s   s u b j e c t s   o f   i n t e r e s t .   F o r   e x a m p l e ,   p e o p l e   n e w   t o   K u b e r n e t e s   m a y   a l s o   w a n t   t o   j o i n   t h e   # k u b e r n e t e s - n o v i c e   c h a n n e l .   A s   a n o t h e r   e x a m p l e ,   d e v e l o p e r s   s h o u l d   j o i n   t h e   # k u b e r n e t e s - c o n t r i b u t o r s   c h a n n e l .   T h e r e   a r e   a l s o   m a n y   c o u n t r y   s p e c i f i c   /   l o c a l   l a n g u a g e   c h a n n e l s .   F e e l   f r e e   t o   j o i n   t h e s e   c h a n n e l s   f o r   l o c a l i z e d   s u p p o r t   a n d   i n f o :


Question: What is Forum?

Answer: Y o u ' r e   w e l c o m e   t o   j o i n   t h e   o f f i c i a l   K u b e r n e t e s   F o r u m :   d i s c u s s . k u b e r n e t e s . i o .


Question: What is Bugs and feature requests?

Answer: I f   y o u   h a v e   w h a t   l o o k s   l i k e   a   b u g ,   o r   y o u   w o u l d   l i k e   t o   m a k e   a   f e a t u r e   r e q u e s t ,   p l e a s e   u s e   t h e   G i t H u b   i s s u e   t r a c k i n g   s y s t e m .   B e f o r e   y o u   f i l e   a n   i s s u e ,   p l e a s e   s e a r c h   e x i s t i n g   i s s u e s   t o   s e e   i f   y o u r   i s s u e   i s   a l r e a d y   c o v e r e d .   I f   f i l i n g   a   b u g ,   p l e a s e   i n c l u d e   d e t a i l e d   i n f o r m a t i o n   a b o u t   h o w   t o   r e p r o d u c e   t h e   p r o b l e m ,   s u c h   a s :   K u b e r n e t e s   v e r s i o n :   k u b e c t l   v e r s i o n C l o u d   p r o v i d e r ,   O S   d i s t r o ,   n e t w o r k   c o n f i g u r a t i o n ,   a n d   c o n t a i n e r   r u n t i m e   v e r s i o n S t e p s   t o   r e p r o d u c e   t h e   p r o b l e m


Question: What is Customizing DNS Service?

Answer: Customizing DNS ServiceThis page explains how to configure your DNS Pod(s) and customize the DNS resolution process in your cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour cluster must be running the CoreDNS add-on.Your Kubernetes server must be at or later than version v1.12.To check the version, enter kubectl version.IntroductionDNS is a built-in Kubernetes service launched automatically using the addon manager cluster add-on.Note:The CoreDNS Service is named kube-dns in the metadata.name field.The intent is to ensure greater interoperability with workloads that relied on the legacy kube-dns Service name to resolve addresses internal to the cluster. Using a Service named kube-dns abstracts away the implementation detail of which DNS provider is running behind that common name.If you are running CoreDNS as a Deployment, it will typically be exposed as a Kubernetes Service with a static IP address. The kubelet passes DNS resolver information to each container with the --cluster-dns=<dns-service-ip> flag.DNS names also need domains. You configure the local domain in the kubelet with the flag --cluster-domain=<default-local-domain>.The DNS server supports forward lookups (A and AAAA records), port lookups (SRV records), reverse IP address lookups (PTR records), and more. For more information, see DNS for Services and Pods.If a Pod's dnsPolicy is set to default, it inherits the name resolution configuration from the node that the Pod runs on. The Pod's DNS resolution should behave the same as the node. But see Known issues.If you don't want this, or if you want a different DNS config for pods, you can use the kubelet's --resolv-conf flag. Set this flag to "" to prevent Pods from inheriting DNS. Set it to a valid file path to specify a file other than /etc/resolv.conf for DNS inheritance.CoreDNSCoreDNS is a general-purpose authoritative DNS server that can serve as cluster DNS, complying with the DNS specifications.CoreDNS ConfigMap optionsCoreDNS is a DNS server that is modular and pluggable, with plugins adding new functionalities. The CoreDNS server can be configured by maintaining a Corefile, which is the CoreDNS configuration file. As a cluster administrator, you can modify the ConfigMap for the CoreDNS Corefile to change how DNS service discovery behaves for that cluster.In Kubernetes, CoreDNS is installed with the following default Corefile configuration:apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods ins


Question: How does Customizing DNS Service work?

Answer: Customizing DNS ServiceThis page explains how to configure your DNS Pod(s) and customize the DNS resolution process in your cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour cluster must be running the CoreDNS add-on.Your Kubernetes server must be at or later than version v1.12.To check the version, enter kubectl version.IntroductionDNS is a built-in Kubernetes service launched automatically using the addon manager cluster add-on.Note:The CoreDNS Service is named kube-dns in the metadata.name field.The intent is to ensure greater interoperability with workloads that relied on the legacy kube-dns Service name to resolve addresses internal to the cluster. Using a Service named kube-dns abstracts away the implementation detail of which DNS provider is running behind that common name.If you are running CoreDNS as a Deployment, it will typically be exposed as a Kubernetes Service with a static IP address. The kubelet passes DNS resolver information to each container with the --cluster-dns=<dns-service-ip> flag.DNS names also need domains. You configure the local domain in the kubelet with the flag --cluster-domain=<default-local-domain>.The DNS server supports forward lookups (A and AAAA records), port lookups (SRV records), reverse IP address lookups (PTR records), and more. For more information, see DNS for Services and Pods.If a Pod's dnsPolicy is set to default, it inherits the name resolution configuration from the node that the Pod runs on. The Pod's DNS resolution should behave the same as the node. But see Known issues.If you don't want this, or if you want a different DNS config for pods, you can use the kubelet's --resolv-conf flag. Set this flag to "" to prevent Pods from inheriting DNS. Set it to a valid file path to specify a file other than /etc/resolv.conf for DNS inheritance.CoreDNSCoreDNS is a general-purpose authoritative DNS server that can serve as cluster DNS, complying with the DNS specifications.CoreDNS ConfigMap optionsCoreDNS is a DNS server that is modular and pluggable, with plugins adding new functionalities. The CoreDNS server can be configured by maintaining a Corefile, which is the CoreDNS configuration file. As a cluster administrator, you can modify the ConfigMap for the CoreDNS Corefile to change how DNS service discovery behaves for that cluster.In Kubernetes, CoreDNS is installed with the following default Corefile configuration:apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods ins


Question: When would you use Customizing DNS Service?

Answer: Customizing DNS ServiceThis page explains how to configure your DNS Pod(s) and customize the DNS resolution process in your cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour cluster must be running the CoreDNS add-on.Your Kubernetes server must be at or later than version v1.12.To check the version, enter kubectl version.IntroductionDNS is a built-in Kubernetes service launched automatically using the addon manager cluster add-on.Note:The CoreDNS Service is named kube-dns in the metadata.name field.The intent is to ensure greater interoperability with workloads that relied on the legacy kube-dns Service name to resolve addresses internal to the cluster. Using a Service named kube-dns abstracts away the implementation detail of which DNS provider is running behind that common name.If you are running CoreDNS as a Deployment, it will typically be exposed as a Kubernetes Service with a static IP address. The kubelet passes DNS resolver information to each container with the --cluster-dns=<dns-service-ip> flag.DNS names also need domains. You configure the local domain in the kubelet with the flag --cluster-domain=<default-local-domain>.The DNS server supports forward lookups (A and AAAA records), port lookups (SRV records), reverse IP address lookups (PTR records), and more. For more information, see DNS for Services and Pods.If a Pod's dnsPolicy is set to default, it inherits the name resolution configuration from the node that the Pod runs on. The Pod's DNS resolution should behave the same as the node. But see Known issues.If you don't want this, or if you want a different DNS config for pods, you can use the kubelet's --resolv-conf flag. Set this flag to "" to prevent Pods from inheriting DNS. Set it to a valid file path to specify a file other than /etc/resolv.conf for DNS inheritance.CoreDNSCoreDNS is a general-purpose authoritative DNS server that can serve as cluster DNS, complying with the DNS specifications.CoreDNS ConfigMap optionsCoreDNS is a DNS server that is modular and pluggable, with plugins adding new functionalities. The CoreDNS server can be configured by maintaining a Corefile, which is the CoreDNS configuration file. As a cluster administrator, you can modify the ConfigMap for the CoreDNS Corefile to change how DNS service discovery behaves for that cluster.In Kubernetes, CoreDNS is installed with the following default Corefile configuration:apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods ins


Question: What are the benefits of Customizing DNS Service?

Answer: Customizing DNS ServiceThis page explains how to configure your DNS Pod(s) and customize the DNS resolution process in your cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour cluster must be running the CoreDNS add-on.Your Kubernetes server must be at or later than version v1.12.To check the version, enter kubectl version.IntroductionDNS is a built-in Kubernetes service launched automatically using the addon manager cluster add-on.Note:The CoreDNS Service is named kube-dns in the metadata.name field.The intent is to ensure greater interoperability with workloads that relied on the legacy kube-dns Service name to resolve addresses internal to the cluster. Using a Service named kube-dns abstracts away the implementation detail of which DNS provider is running behind that common name.If you are running CoreDNS as a Deployment, it will typically be exposed as a Kubernetes Service with a static IP address. The kubelet passes DNS resolver information to each container with the --cluster-dns=<dns-service-ip> flag.DNS names also need domains. You configure the local domain in the kubelet with the flag --cluster-domain=<default-local-domain>.The DNS server supports forward lookups (A and AAAA records), port lookups (SRV records), reverse IP address lookups (PTR records), and more. For more information, see DNS for Services and Pods.If a Pod's dnsPolicy is set to default, it inherits the name resolution configuration from the node that the Pod runs on. The Pod's DNS resolution should behave the same as the node. But see Known issues.If you don't want this, or if you want a different DNS config for pods, you can use the kubelet's --resolv-conf flag. Set this flag to "" to prevent Pods from inheriting DNS. Set it to a valid file path to specify a file other than /etc/resolv.conf for DNS inheritance.CoreDNSCoreDNS is a general-purpose authoritative DNS server that can serve as cluster DNS, complying with the DNS specifications.CoreDNS ConfigMap optionsCoreDNS is a DNS server that is modular and pluggable, with plugins adding new functionalities. The CoreDNS server can be configured by maintaining a Corefile, which is the CoreDNS configuration file. As a cluster administrator, you can modify the ConfigMap for the CoreDNS Corefile to change how DNS service discovery behaves for that cluster.In Kubernetes, CoreDNS is installed with the following default Corefile configuration:apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods ins


Question: What is Customizing DNS Service?

Answer: T h i s   p a g e   e x p l a i n s   h o w   t o   c o n f i g u r e   y o u r   D N S   P o d ( s )   a n d   c u s t o m i z e   t h e   D N S   r e s o l u t i o n   p r o c e s s   i n   y o u r   c l u s t e r .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   Y o u r   c l u s t e r   m u s t   b e   r u n n i n g   t h e   C o r e D N S   a d d - o n .   Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 1 2 .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Introduction?

Answer: D N S   i s   a   b u i l t - i n   K u b e r n e t e s   s e r v i c e   l a u n c h e d   a u t o m a t i c a l l y   u s i n g   t h e   a d d o n   m a n a g e r   c l u s t e r   a d d - o n .


Question: What is Note:?

Answer: I f   y o u   a r e   r u n n i n g   C o r e D N S   a s   a   D e p l o y m e n t ,   i t   w i l l   t y p i c a l l y   b e   e x p o s e d   a s   a   K u b e r n e t e s   S e r v i c e   w i t h   a   s t a t i c   I P   a d d r e s s .   T h e   k u b e l e t   p a s s e s   D N S   r e s o l v e r   i n f o r m a t i o n   t o   e a c h   c o n t a i n e r   w i t h   t h e   - - c l u s t e r - d n s = < d n s - s e r v i c e - i p >   f l a g .   D N S   n a m e s   a l s o   n e e d   d o m a i n s .   Y o u   c o n f i g u r e   t h e   l o c a l   d o m a i n   i n   t h e   k u b e l e t   w i t h   t h e   f l a g   - - c l u s t e r - d o m a i n = < d e f a u l t - l o c a l - d o m a i n > .   T h e   D N S   s e r v e r   s u p p o r t s   f o r w a r d   l o o k u p s   ( A   a n d   A A A A   r e c o r d s ) ,   p o r t   l o o k u p s   ( S R V   r e c o r d s ) ,   r e v e r s e   I P   a d d r e s s   l o o k u p s   ( P T R   r e c o r d s ) ,   a n d   m o r e .   F o r   m o r e   i n f o r m a t i o n ,   s e e   D N S   f o r   S e r v i c e s   a n d   P o d s .   I f   a   P o d ' s   d n s P o l i c y   i s   s e t   t o   d e f a u l t ,   i t   i n h e r i t s   t h e   n a m e   r e s o l u t i o n   c o n f i g u r a t i o n   f r o m   t h e   n o d e   t h a t   t h e   P o d   r u n s   o n .   T h e   P o d ' s   D N S   r e s o l u t i o n   s h o u l d   b e h a v e   t h e   s a m e   a s   t h e   n o d e .   B u t   s e e   K n o w n   i s s u e s .   I f   y o u   d o n ' t   w a n t   t h i s ,   o r   i f   y o u   w a n t   a   d i f f e r e n t   D N S   c o n f i g   f o r   p o d s ,   y o u   c a n   u s e   t h e   k u b e l e t ' s   - - r e s o l v - c o n f   f l a g .   S e t   t h i s   f l a g   t o   " "   t o   p r e v e n t   P o d s   f r o m   i n h e r i t i n g   D N S .   S e t   i t   t o   a   v a l i d   f i l e   p a t h   t o   s p e c i f y   a   f i l e   o t h e r   t h a n   / e t c / r e


Question: What is CoreDNS?

Answer: C o r e D N S   i s   a   g e n e r a l - p u r p o s e   a u t h o r i t a t i v e   D N S   s e r v e r   t h a t   c a n   s e r v e   a s   c l u s t e r   D N S ,   c o m p l y i n g   w i t h   t h e   D N S   s p e c i f i c a t i o n s .


Question: What is CoreDNS ConfigMap options?

Answer: C o r e D N S   i s   a   D N S   s e r v e r   t h a t   i s   m o d u l a r   a n d   p l u g g a b l e ,   w i t h   p l u g i n s   a d d i n g   n e w   f u n c t i o n a l i t i e s .   T h e   C o r e D N S   s e r v e r   c a n   b e   c o n f i g u r e d   b y   m a i n t a i n i n g   a   C o r e f i l e ,   w h i c h   i s   t h e   C o r e D N S   c o n f i g u r a t i o n   f i l e .   A s   a   c l u s t e r   a d m i n i s t r a t o r ,   y o u   c a n   m o d i f y   t h e   C o n f i g M a p   f o r   t h e   C o r e D N S   C o r e f i l e   t o   c h a n g e   h o w   D N S   s e r v i c e   d i s c o v e r y   b e h a v e s   f o r   t h a t   c l u s t e r .   I n   K u b e r n e t e s ,   C o r e D N S   i s   i n s t a l l e d   w i t h   t h e   f o l l o w i n g   d e f a u l t   C o r e f i l e   c o n f i g u r a t i o n :   a p i V e r s i o n :   v 1   k i n d :   C o n f i g M a p   m e t a d a t a :   n a m e :   c o r e d n s   n a m e s p a c e :   k u b e - s y s t e m   d a t a :   C o r e f i l e :   |   . : 5 3   {   e r r o r s   h e a l t h   {   l a m e d u c k   5 s   }   r e a d y   k u b e r n e t e s   c l u s t e r . l o c a l   i n - a d d r . a r p a   i p 6 . a r p a   {   p o d s   i n s e c u r e   f a l l t h r o u g h   i n - a d d r . a r p a   i p 6 . a r p a   t t l   3 0   }   p r o m e t h e u s   : 9 1 5 3   f o r w a r d   .   / e t c / r e s o l v . c o n f   c a c h e   3 0   l o o p   r e l o a d   l o a d b a l a n c e   }   T h e   C o r e f i l e   c o n f i g u r a t i o n   i n c l u d e s   t h e   f o l l o w i n g   p l u g i n s   o f   C o r e D N S :   e r r o r s :   E r r o r s   a r e   l o g g e d   t o   s t d o u t . h e a l t h :   H e a l t h   o f   C o r e D N S   i s   r e p o r t e d   t o   h t t p : / / l o c a l h o s t : 8 0 8 0 / h e a l t h .   I n   t h i s   e x t e n d e d   s y n t a x   l a m e d u c k   w i l l   m a k e   t h e   p r o c e s s   u n h e a l t h y   t h


Question: What is Configuration of Stub-domain and upstream nameserver using CoreDNS?

Answer: C o r e D N S   h a s   t h e   a b i l i t y   t o   c o n f i g u r e   s t u b - d o m a i n s   a n d   u p s t r e a m   n a m e s e r v e r s   u s i n g   t h e   f o r w a r d   p l u g i n .


Question: What is Example?

Answer: I f   a   c l u s t e r   o p e r a t o r   h a s   a   C o n s u l   d o m a i n   s e r v e r   l o c a t e d   a t   " 1 0 . 1 5 0 . 0 . 1 " ,   a n d   a l l   C o n s u l   n a m e s   h a v e   t h e   s u f f i x   " . c o n s u l . l o c a l " .   T o   c o n f i g u r e   i t   i n   C o r e D N S ,   t h e   c l u s t e r   a d m i n i s t r a t o r   c r e a t e s   t h e   f o l l o w i n g   s t a n z a   i n   t h e   C o r e D N S   C o n f i g M a p .   c o n s u l . l o c a l : 5 3   {   e r r o r s   c a c h e   3 0   f o r w a r d   .   1 0 . 1 5 0 . 0 . 1   }   T o   e x p l i c i t l y   f o r c e   a l l   n o n - c l u s t e r   D N S   l o o k u p s   t o   g o   t h r o u g h   a   s p e c i f i c   n a m e s e r v e r   a t   1 7 2 . 1 6 . 0 . 1 ,   p o i n t   t h e   f o r w a r d   t o   t h e   n a m e s e r v e r   i n s t e a d   o f   / e t c / r e s o l v . c o n f   f o r w a r d   .   1 7 2 . 1 6 . 0 . 1   T h e   f i n a l   C o n f i g M a p   a l o n g   w i t h   t h e   d e f a u l t   C o r e f i l e   c o n f i g u r a t i o n   l o o k s   l i k e :   a p i V e r s i o n :   v 1   k i n d :   C o n f i g M a p   m e t a d a t a :   n a m e :   c o r e d n s   n a m e s p a c e :   k u b e - s y s t e m   d a t a :   C o r e f i l e :   |   . : 5 3   {   e r r o r s   h e a l t h   k u b e r n e t e s   c l u s t e r . l o c a l   i n - a d d r . a r p a   i p 6 . a r p a   {   p o d s   i n s e c u r e   f a l l t h r o u g h   i n - a d d r . a r p a   i p 6 . a r p a   }   p r o m e t h e u s   : 9 1 5 3   f o r w a r d   .   1 7 2 . 1 6 . 0 . 1   c a c h e   3 0   l o o p   r e l o a d   l o a d b a l a n c e   }   c o n s u l . l o c a l : 5 3   {   e r r o r s   c a c h e   3 0   f o r w a r d   .   1 0 . 1 5 0 . 0 . 1   }


Question: What is What's next?

Answer: R e a d   D e b u g g i n g   D N S   R e s o l u t i o n


Question: What is Debugging Kubernetes Nodes With Kubectl?

Answer: Debugging Kubernetes Nodes With KubectlThis page shows how to debug a node running on the Kubernetes cluster using kubectl debug command.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version 1.2.To check the version, enter kubectl version.You need to have permission to create Pods and to assign those new Pods to arbitrary nodes. You also need to be authorized to create Pods that access filesystems from the host.Debugging a Node using kubectl debug nodeUse the kubectl debug node command to deploy a Pod to a Node that you want to troubleshoot. This command is helpful in scenarios where you can't access your Node by using an SSH connection. When the Pod is created, the Pod opens an interactive shell on the Node. To create an interactive shell on a Node named “mynode”, run:kubectl debug node/mynode -it --image=ubuntu Creating debugging pod node-debugger-mynode-pdx84 with container debugger on node mynode. If you don't see a command prompt, try pressing enter. root@mynode:/# The debug command helps to gather information and troubleshoot issues. Commands that you might use include ip, ifconfig, nc, ping, and ps and so on. You can also install other tools, such as mtr, tcpdump, and curl, from the respective package manager.Note:The debug commands may differ based on the image the debugging pod is using and these commands might need to be installed.The debugging Pod can access the root filesystem of the Node, mounted at /host in the Pod. If you run your kubelet in a filesystem namespace, the debugging Pod sees the root for that namespace, not for the entire node. For a typical Linux node, you can look at the following paths to find relevant logs:/host/var/log/kubelet.logLogs from the kubelet, responsible for running containers on the node./host/var/log/kube-proxy.logLogs from kube-proxy, which is responsible for directing traffic to Service endpoints./host/var/log/containerd.logLogs from the containerd process running on the node./host/var/log/syslogShows general messages and information regarding the system./host/var/log/kern.logShows kernel logs.When creating a debugging session on a Node, keep in mind that:kubectl debug automatically generates the name of the new pod, based on the name of the node.The root filesystem of the Node will be mounted at /host.Although the container runs in the host IPC, Network, and PID namespaces, the pod isn't privileged. This means that reading some process information might fail because access to that information is restricted to superusers. For example, chroot /host will fail. If you ne