Question: When would you use Assign Pods to Nodes using Node Affinity?

Answer: Assign Pods to Nodes using Node AffinityThis page shows how to assign a Kubernetes Pod to a particular node using Node Affinity in a Kubernetes cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.10.To check the version, enter kubectl version.Add a label to a nodeList the nodes in your cluster, along with their labels:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 Choose one of your nodes, and add a label to it:kubectl label nodes <your-node-name> disktype=ssd where <your-node-name> is the name of your chosen node.Verify that your chosen node has a disktype=ssd label:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,disktype=ssd,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 In the preceding output, you can see that the worker0 node has a disktype=ssd label.Schedule a Pod using required node affinityThis manifest describes a Pod that has a requiredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will get scheduled only on a node that has a disktype=ssd label.pods/pod-nginx-required-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: disktype operator: In values: - ssd containers: - name: nginx image: nginx imagePullPolicy: IfNotPresent Apply the manifest to create a Pod that is scheduled onto your chosen node:kubectl apply -f https://k8s.io/examples/pods/pod-nginx-required-affinity.yaml Verify that the pod is running on your chosen node:kubectl get pods --output=wide The output is similar to this:NAME READY STATUS RESTARTS AGE IP NODE nginx 1/1 Running 0 13s 10.200.0.4 worker0 Schedule a Pod using preferred node affinityThis manifest describes a Pod that has a preferredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will prefer a node that has a disktype=ssd label.pods/pod-nginx-preferred-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1


Question: What are the benefits of Assign Pods to Nodes using Node Affinity?

Answer: Assign Pods to Nodes using Node AffinityThis page shows how to assign a Kubernetes Pod to a particular node using Node Affinity in a Kubernetes cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.10.To check the version, enter kubectl version.Add a label to a nodeList the nodes in your cluster, along with their labels:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 Choose one of your nodes, and add a label to it:kubectl label nodes <your-node-name> disktype=ssd where <your-node-name> is the name of your chosen node.Verify that your chosen node has a disktype=ssd label:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,disktype=ssd,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 In the preceding output, you can see that the worker0 node has a disktype=ssd label.Schedule a Pod using required node affinityThis manifest describes a Pod that has a requiredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will get scheduled only on a node that has a disktype=ssd label.pods/pod-nginx-required-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: disktype operator: In values: - ssd containers: - name: nginx image: nginx imagePullPolicy: IfNotPresent Apply the manifest to create a Pod that is scheduled onto your chosen node:kubectl apply -f https://k8s.io/examples/pods/pod-nginx-required-affinity.yaml Verify that the pod is running on your chosen node:kubectl get pods --output=wide The output is similar to this:NAME READY STATUS RESTARTS AGE IP NODE nginx 1/1 Running 0 13s 10.200.0.4 worker0 Schedule a Pod using preferred node affinityThis manifest describes a Pod that has a preferredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will prefer a node that has a disktype=ssd label.pods/pod-nginx-preferred-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1


Question: What is Assign Pods to Nodes using Node Affinity?

Answer: T h i s   p a g e   s h o w s   h o w   t o   a s s i g n   a   K u b e r n e t e s   P o d   t o   a   p a r t i c u l a r   n o d e   u s i n g   N o d e   A f f i n i t y   i n   a   K u b e r n e t e s   c l u s t e r .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 1 0 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Add a label to a node?

Answer: L i s t   t h e   n o d e s   i n   y o u r   c l u s t e r ,   a l o n g   w i t h   t h e i r   l a b e l s : k u b e c t l   g e t   n o d e s   - - s h o w - l a b e l s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   S T A T U S   R O L E S   A G E   V E R S I O N   L A B E L S   w o r k e r 0   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 0   w o r k e r 1   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 1   w o r k e r 2   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 2   C h o o s e   o n e   o f   y o u r   n o d e s ,   a n d   a d d   a   l a b e l   t o   i t : k u b e c t l   l a b e l   n o d e s   < y o u r - n o d e - n a m e >   d i s k t y p e = s s d   w h e r e   < y o u r - n o d e - n a m e >   i s   t h e   n a m e   o f   y o u r   c h o s e n   n o d e . V e r i f y   t h a t   y o u r   c h o s e n   n o d e   h a s   a   d i s k t y p e = s s d   l a b e l : k u b e c t l   g e t   n o d e s   - - s h o w - l a b e l s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   S T A T U S   R O L E S   A G E   V E R S I O N   L A B E L S   w o r k e r 0   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , d i s k t y p e = s s d , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 0   w o r k e r 1   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 1   w o r k e r 2   R e a d y   < n o n e >   1 d   v 1 . 1 3 . 0   . . . , k u b e r n e t e s . i o / h o s t n a m e = w o r k e r 2   I n   t h e   p r e c e d i n g   o u t p u t ,   y o u   c a n   s e e   t h a t   t h e   w o r k e r 0   n o d e   h a s   a   d i s k t y p e = s s d   l a b e l .   L i s t   t h e   n o d e s   i n   y o u r   c l u s t e r ,   a l o n g   w


Question: What is Schedule a Pod using required node affinity?

Answer: T h i s   m a n i f e s t   d e s c r i b e s   a   P o d   t h a t   h a s   a   r e q u i r e d D u r i n g S c h e d u l i n g I g n o r e d D u r i n g E x e c u t i o n   n o d e   a f f i n i t y , d i s k t y p e :   s s d .   T h i s   m e a n s   t h a t   t h e   p o d   w i l l   g e t   s c h e d u l e d   o n l y   o n   a   n o d e   t h a t   h a s   a   d i s k t y p e = s s d   l a b e l .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   n g i n x   s p e c :   a f f i n i t y :   n o d e A f f i n i t y :   r e q u i r e d D u r i n g S c h e d u l i n g I g n o r e d D u r i n g E x e c u t i o n :   n o d e S e l e c t o r T e r m s :   -   m a t c h E x p r e s s i o n s :   -   k e y :   d i s k t y p e   o p e r a t o r :   I n   v a l u e s :   -   s s d   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   i m a g e P u l l P o l i c y :   I f N o t P r e s e n t   A p p l y   t h e   m a n i f e s t   t o   c r e a t e   a   P o d   t h a t   i s   s c h e d u l e d   o n t o   y o u r   c h o s e n   n o d e : k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / p o d - n g i n x - r e q u i r e d - a f f i n i t y . y a m l   V e r i f y   t h a t   t h e   p o d   i s   r u n n i n g   o n   y o u r   c h o s e n   n o d e : k u b e c t l   g e t   p o d s   - - o u t p u t = w i d e   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   I P   N O D E   n g i n x   1 / 1   R u n n i n g   0   1 3 s   1 0 . 2 0 0 . 0 . 4   w o r k e r 0   A p p l y   t h e   m a n i f e s t   t o   c r e a t e   a   P o d   t h a t   i s   s c h e d u l e d   o n t o   y o u r   c h o s e n   n o d e :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / p o d - n g i n x - r e q u i r e d - a f f i n i t y . y a m l   V e r i f y   t h a t   t h e


Question: What is Schedule a Pod using preferred node affinity?

Answer: T h i s   m a n i f e s t   d e s c r i b e s   a   P o d   t h a t   h a s   a   p r e f e r r e d D u r i n g S c h e d u l i n g I g n o r e d D u r i n g E x e c u t i o n   n o d e   a f f i n i t y , d i s k t y p e :   s s d .   T h i s   m e a n s   t h a t   t h e   p o d   w i l l   p r e f e r   a   n o d e   t h a t   h a s   a   d i s k t y p e = s s d   l a b e l .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   n g i n x   s p e c :   a f f i n i t y :   n o d e A f f i n i t y :   p r e f e r r e d D u r i n g S c h e d u l i n g I g n o r e d D u r i n g E x e c u t i o n :   -   w e i g h t :   1   p r e f e r e n c e :   m a t c h E x p r e s s i o n s :   -   k e y :   d i s k t y p e   o p e r a t o r :   I n   v a l u e s :   -   s s d   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   i m a g e P u l l P o l i c y :   I f N o t P r e s e n t   A p p l y   t h e   m a n i f e s t   t o   c r e a t e   a   P o d   t h a t   i s   s c h e d u l e d   o n t o   y o u r   c h o s e n   n o d e : k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / p o d - n g i n x - p r e f e r r e d - a f f i n i t y . y a m l   V e r i f y   t h a t   t h e   p o d   i s   r u n n i n g   o n   y o u r   c h o s e n   n o d e : k u b e c t l   g e t   p o d s   - - o u t p u t = w i d e   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   I P   N O D E   n g i n x   1 / 1   R u n n i n g   0   1 3 s   1 0 . 2 0 0 . 0 . 4   w o r k e r 0   A p p l y   t h e   m a n i f e s t   t o   c r e a t e   a   P o d   t h a t   i s   s c h e d u l e d   o n t o   y o u r   c h o s e n   n o d e :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / p o d - n g i n x - p r e f e r r e d - a f f i n i t y . y a m l   V e r i f y   t h a t   t h e   p o d   i s


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   N o d e   A f f i n i t y .


Question: What is Restrict a Container's Access to Resources with AppArmor?

Answer: Restrict a Container's Access to Resources with AppArmorFEATURE STATE: Kubernetes v1.31 [stable] (enabled by default: true)This page shows you how to load AppArmor profiles on your nodes and enforce those profiles in Pods. To learn more about how Kubernetes can confine Pods using AppArmor, see Linux kernel security constraints for Pods and containers.ObjectivesSee an example of how to load a profile on a NodeLearn how to enforce the profile on a PodLearn how to check that the profile is loadedSee what happens when a profile is violatedSee what happens when a profile cannot be loadedBefore you beginAppArmor is an optional kernel module and Kubernetes feature, so verify it is supported on your Nodes before proceeding:AppArmor kernel module is enabled -- For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the /sys/module/apparmor/parameters/enabled file:cat /sys/module/apparmor/parameters/enabled Y The kubelet verifies that AppArmor is enabled on the host before admitting a pod with AppArmor explicitly configured.Container runtime supports AppArmor -- All common Kubernetes-supported container runtimes should support AppArmor, including containerd and CRI-O. Please refer to the corresponding runtime documentation and verify that the cluster fulfills the requirements to use AppArmor.Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles are not loaded in the kernel, the kubelet will reject the Pod. You can view which profiles are loaded on a node by checking the /sys/kernel/security/apparmor/profiles file. For example:ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) For more details on loading profiles on nodes, see Setting up nodes with profiles.Securing a PodNote:Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.AppArmor profiles can be specified at the pod level or container level. The container AppArmor profile takes precedence over the pod profile.securityContext: appArmorProfile: type: <profile_type> Where <profile_type> is one of:RuntimeDefault to use the runtime's default profileLocalhost to use a profile loaded on the host (see below)Unconfined to run without AppArmorSee Specifying AppArmor Confinement for full details on the AppArmor profile API.To verify that the profile was applied, you can check that the container's root process is running with the correct profile by examining its proc attr:kubectl exec <pod_name> -- cat /proc/1/attr/current The out


Question: How does Restrict a Container's Access to Resources with AppArmor work?

Answer: Restrict a Container's Access to Resources with AppArmorFEATURE STATE: Kubernetes v1.31 [stable] (enabled by default: true)This page shows you how to load AppArmor profiles on your nodes and enforce those profiles in Pods. To learn more about how Kubernetes can confine Pods using AppArmor, see Linux kernel security constraints for Pods and containers.ObjectivesSee an example of how to load a profile on a NodeLearn how to enforce the profile on a PodLearn how to check that the profile is loadedSee what happens when a profile is violatedSee what happens when a profile cannot be loadedBefore you beginAppArmor is an optional kernel module and Kubernetes feature, so verify it is supported on your Nodes before proceeding:AppArmor kernel module is enabled -- For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the /sys/module/apparmor/parameters/enabled file:cat /sys/module/apparmor/parameters/enabled Y The kubelet verifies that AppArmor is enabled on the host before admitting a pod with AppArmor explicitly configured.Container runtime supports AppArmor -- All common Kubernetes-supported container runtimes should support AppArmor, including containerd and CRI-O. Please refer to the corresponding runtime documentation and verify that the cluster fulfills the requirements to use AppArmor.Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles are not loaded in the kernel, the kubelet will reject the Pod. You can view which profiles are loaded on a node by checking the /sys/kernel/security/apparmor/profiles file. For example:ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) For more details on loading profiles on nodes, see Setting up nodes with profiles.Securing a PodNote:Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.AppArmor profiles can be specified at the pod level or container level. The container AppArmor profile takes precedence over the pod profile.securityContext: appArmorProfile: type: <profile_type> Where <profile_type> is one of:RuntimeDefault to use the runtime's default profileLocalhost to use a profile loaded on the host (see below)Unconfined to run without AppArmorSee Specifying AppArmor Confinement for full details on the AppArmor profile API.To verify that the profile was applied, you can check that the container's root process is running with the correct profile by examining its proc attr:kubectl exec <pod_name> -- cat /proc/1/attr/current The out


Question: When would you use Restrict a Container's Access to Resources with AppArmor?

Answer: Restrict a Container's Access to Resources with AppArmorFEATURE STATE: Kubernetes v1.31 [stable] (enabled by default: true)This page shows you how to load AppArmor profiles on your nodes and enforce those profiles in Pods. To learn more about how Kubernetes can confine Pods using AppArmor, see Linux kernel security constraints for Pods and containers.ObjectivesSee an example of how to load a profile on a NodeLearn how to enforce the profile on a PodLearn how to check that the profile is loadedSee what happens when a profile is violatedSee what happens when a profile cannot be loadedBefore you beginAppArmor is an optional kernel module and Kubernetes feature, so verify it is supported on your Nodes before proceeding:AppArmor kernel module is enabled -- For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the /sys/module/apparmor/parameters/enabled file:cat /sys/module/apparmor/parameters/enabled Y The kubelet verifies that AppArmor is enabled on the host before admitting a pod with AppArmor explicitly configured.Container runtime supports AppArmor -- All common Kubernetes-supported container runtimes should support AppArmor, including containerd and CRI-O. Please refer to the corresponding runtime documentation and verify that the cluster fulfills the requirements to use AppArmor.Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles are not loaded in the kernel, the kubelet will reject the Pod. You can view which profiles are loaded on a node by checking the /sys/kernel/security/apparmor/profiles file. For example:ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) For more details on loading profiles on nodes, see Setting up nodes with profiles.Securing a PodNote:Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.AppArmor profiles can be specified at the pod level or container level. The container AppArmor profile takes precedence over the pod profile.securityContext: appArmorProfile: type: <profile_type> Where <profile_type> is one of:RuntimeDefault to use the runtime's default profileLocalhost to use a profile loaded on the host (see below)Unconfined to run without AppArmorSee Specifying AppArmor Confinement for full details on the AppArmor profile API.To verify that the profile was applied, you can check that the container's root process is running with the correct profile by examining its proc attr:kubectl exec <pod_name> -- cat /proc/1/attr/current The out


Question: What are the benefits of Restrict a Container's Access to Resources with AppArmor?

Answer: Restrict a Container's Access to Resources with AppArmorFEATURE STATE: Kubernetes v1.31 [stable] (enabled by default: true)This page shows you how to load AppArmor profiles on your nodes and enforce those profiles in Pods. To learn more about how Kubernetes can confine Pods using AppArmor, see Linux kernel security constraints for Pods and containers.ObjectivesSee an example of how to load a profile on a NodeLearn how to enforce the profile on a PodLearn how to check that the profile is loadedSee what happens when a profile is violatedSee what happens when a profile cannot be loadedBefore you beginAppArmor is an optional kernel module and Kubernetes feature, so verify it is supported on your Nodes before proceeding:AppArmor kernel module is enabled -- For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the /sys/module/apparmor/parameters/enabled file:cat /sys/module/apparmor/parameters/enabled Y The kubelet verifies that AppArmor is enabled on the host before admitting a pod with AppArmor explicitly configured.Container runtime supports AppArmor -- All common Kubernetes-supported container runtimes should support AppArmor, including containerd and CRI-O. Please refer to the corresponding runtime documentation and verify that the cluster fulfills the requirements to use AppArmor.Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles are not loaded in the kernel, the kubelet will reject the Pod. You can view which profiles are loaded on a node by checking the /sys/kernel/security/apparmor/profiles file. For example:ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) For more details on loading profiles on nodes, see Setting up nodes with profiles.Securing a PodNote:Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.AppArmor profiles can be specified at the pod level or container level. The container AppArmor profile takes precedence over the pod profile.securityContext: appArmorProfile: type: <profile_type> Where <profile_type> is one of:RuntimeDefault to use the runtime's default profileLocalhost to use a profile loaded on the host (see below)Unconfined to run without AppArmorSee Specifying AppArmor Confinement for full details on the AppArmor profile API.To verify that the profile was applied, you can check that the container's root process is running with the correct profile by examining its proc attr:kubectl exec <pod_name> -- cat /proc/1/attr/current The out


Question: What is Restrict a Container's Access to Resources with AppArmor?

Answer: T h i s   p a g e   s h o w s   y o u   h o w   t o   l o a d   A p p A r m o r   p r o f i l e s   o n   y o u r   n o d e s   a n d   e n f o r c e   t h o s e   p r o f i l e s   i n   P o d s .   T o   l e a r n   m o r e   a b o u t   h o w   K u b e r n e t e s   c a n   c o n f i n e   P o d s   u s i n g   A p p A r m o r ,   s e e   L i n u x   k e r n e l   s e c u r i t y   c o n s t r a i n t s   f o r   P o d s   a n d   c o n t a i n e r s .


Question: What is Objectives?

Answer: S e e   a n   e x a m p l e   o f   h o w   t o   l o a d   a   p r o f i l e   o n   a   N o d e L e a r n   h o w   t o   e n f o r c e   t h e   p r o f i l e   o n   a   P o d L e a r n   h o w   t o   c h e c k   t h a t   t h e   p r o f i l e   i s   l o a d e d S e e   w h a t   h a p p e n s   w h e n   a   p r o f i l e   i s   v i o l a t e d S e e   w h a t   h a p p e n s   w h e n   a   p r o f i l e   c a n n o t   b e   l o a d e d


Question: What is Before you begin?

Answer: A p p A r m o r   i s   a n   o p t i o n a l   k e r n e l   m o d u l e   a n d   K u b e r n e t e s   f e a t u r e ,   s o   v e r i f y   i t   i s   s u p p o r t e d   o n   y o u r   N o d e s   b e f o r e   p r o c e e d i n g :   A p p A r m o r   k e r n e l   m o d u l e   i s   e n a b l e d   - -   F o r   t h e   L i n u x   k e r n e l   t o   e n f o r c e   a n   A p p A r m o r   p r o f i l e ,   t h e   A p p A r m o r   k e r n e l   m o d u l e   m u s t   b e   i n s t a l l e d   a n d   e n a b l e d .   S e v e r a l   d i s t r i b u t i o n s   e n a b l e   t h e   m o d u l e   b y   d e f a u l t ,   s u c h   a s   U b u n t u   a n d   S U S E ,   a n d   m a n y   o t h e r s   p r o v i d e   o p t i o n a l   s u p p o r t .   T o   c h e c k   w h e t h e r   t h e   m o d u l e   i s   e n a b l e d ,   c h e c k   t h e   / s y s / m o d u l e / a p p a r m o r / p a r a m e t e r s / e n a b l e d   f i l e : c a t   / s y s / m o d u l e / a p p a r m o r / p a r a m e t e r s / e n a b l e d   Y   T h e   k u b e l e t   v e r i f i e s   t h a t   A p p A r m o r   i s   e n a b l e d   o n   t h e   h o s t   b e f o r e   a d m i t t i n g   a   p o d   w i t h   A p p A r m o r   e x p l i c i t l y   c o n f i g u r e d . C o n t a i n e r   r u n t i m e   s u p p o r t s   A p p A r m o r   - -   A l l   c o m m o n   K u b e r n e t e s - s u p p o r t e d   c o n t a i n e r   r u n t i m e s   s h o u l d   s u p p o r t   A p p A r m o r ,   i n c l u d i n g   c o n t a i n e r d   a n d   C R I - O .   P l e a s e   r e f e r   t o   t h e   c o r r e s p o n d i n g   r u n t i m e   d o c u m e n t a t i o n   a n d   v e r i f y   t h a t   t h e   c l u s t e r   f u l f i l l s   t h e   r e q u i r e m e n t s   t o   u s e   A p p A r m o r . P r o f i l e   i s   l o a d e d   - -   A p p A r m o r   i s   a p p l i e d   t o   a   P o d   b y   s p e c i f y i n g   a n   A p p A r m o r   p r o f i


Question: What is Note:?

Answer: A p p A r m o r   p r o f i l e s   c a n   b e   s p e c i f i e d   a t   t h e   p o d   l e v e l   o r   c o n t a i n e r   l e v e l .   T h e   c o n t a i n e r   A p p A r m o r   p r o f i l e   t a k e s   p r e c e d e n c e   o v e r   t h e   p o d   p r o f i l e .   s e c u r i t y C o n t e x t :   a p p A r m o r P r o f i l e :   t y p e :   < p r o f i l e _ t y p e >   W h e r e   < p r o f i l e _ t y p e >   i s   o n e   o f :   R u n t i m e D e f a u l t   t o   u s e   t h e   r u n t i m e ' s   d e f a u l t   p r o f i l e L o c a l h o s t   t o   u s e   a   p r o f i l e   l o a d e d   o n   t h e   h o s t   ( s e e   b e l o w ) U n c o n f i n e d   t o   r u n   w i t h o u t   A p p A r m o r   S e e   S p e c i f y i n g   A p p A r m o r   C o n f i n e m e n t   f o r   f u l l   d e t a i l s   o n   t h e   A p p A r m o r   p r o f i l e   A P I .   T o   v e r i f y   t h a t   t h e   p r o f i l e   w a s   a p p l i e d ,   y o u   c a n   c h e c k   t h a t   t h e   c o n t a i n e r ' s   r o o t   p r o c e s s   i s   r u n n i n g   w i t h   t h e   c o r r e c t   p r o f i l e   b y   e x a m i n i n g   i t s   p r o c   a t t r :   k u b e c t l   e x e c   < p o d _ n a m e >   - -   c a t   / p r o c / 1 / a t t r / c u r r e n t   T h e   o u t p u t   s h o u l d   l o o k   s o m e t h i n g   l i k e   t h i s :   c r i - c o n t a i n e r d . a p p a r m o r . d   ( e n f o r c e )


Question: What is Example?

Answer: T h i s   e x a m p l e   a s s u m e s   y o u   h a v e   a l r e a d y   s e t   u p   a   c l u s t e r   w i t h   A p p A r m o r   s u p p o r t .   F i r s t ,   l o a d   t h e   p r o f i l e   y o u   w a n t   t o   u s e   o n t o   y o u r   N o d e s .   T h i s   p r o f i l e   b l o c k s   a l l   f i l e   w r i t e   o p e r a t i o n s :   # i n c l u d e   < t u n a b l e s / g l o b a l >   p r o f i l e   k 8 s - a p p a r m o r - e x a m p l e - d e n y - w r i t e   f l a g s = ( a t t a c h _ d i s c o n n e c t e d )   {   # i n c l u d e   < a b s t r a c t i o n s / b a s e >   f i l e ,   #   D e n y   a l l   f i l e   w r i t e s .   d e n y   / * *   w ,   }   T h e   p r o f i l e   n e e d s   t o   b e   l o a d e d   o n t o   a l l   n o d e s ,   s i n c e   y o u   d o n ' t   k n o w   w h e r e   t h e   p o d   w i l l   b e   s c h e d u l e d .   F o r   t h i s   e x a m p l e   y o u   c a n   u s e   S S H   t o   i n s t a l l   t h e   p r o f i l e s ,   b u t   o t h e r   a p p r o a c h e s   a r e   d i s c u s s e d   i n   S e t t i n g   u p   n o d e s   w i t h   p r o f i l e s .   #   T h i s   e x a m p l e   a s s u m e s   t h a t   n o d e   n a m e s   m a t c h   h o s t   n a m e s ,   a n d   a r e   r e a c h a b l e   v i a   S S H .   N O D E S = ( $ (   k u b e c t l   g e t   n o d e   - o   j s o n p a t h = ' { . i t e m s [ * ] . s t a t u s . a d d r e s s e s [ ? ( . t y p e   = =   " H o s t n a m e " ) ] . a d d r e s s } '   ) )   f o r   N O D E   i n   $ { N O D E S [ * ] } ;   d o   s s h   $ N O D E   ' s u d o   a p p a r m o r _ p a r s e r   - q   < < E O F   # i n c l u d e   < t u n a b l e s / g l o b a l >   p r o f i l e   k 8 s - a p p a r m o r - e x a m p l e - d e n y - w r i t e   f l a g s = ( a t t a c h _ d i s c o n n e c t e d )   {   # i n c l u d e   < a b s t r a c t i o n s / b a s e >   f i l e ,   #   D e n y   a l l   f i l e   w r i t e s .   d e n y


Question: What is Setting up Nodes with profiles?

Answer: K u b e r n e t e s   1 . 3 4   d o e s   n o t   p r o v i d e   a n y   b u i l t - i n   m e c h a n i s m s   f o r   l o a d i n g   A p p A r m o r   p r o f i l e s   o n t o   N o d e s .   P r o f i l e s   c a n   b e   l o a d e d   t h r o u g h   c u s t o m   i n f r a s t r u c t u r e   o r   t o o l s   l i k e   t h e   K u b e r n e t e s   S e c u r i t y   P r o f i l e s   O p e r a t o r .   T h e   s c h e d u l e r   i s   n o t   a w a r e   o f   w h i c h   p r o f i l e s   a r e   l o a d e d   o n t o   w h i c h   N o d e ,   s o   t h e   f u l l   s e t   o f   p r o f i l e s   m u s t   b e   l o a d e d   o n t o   e v e r y   N o d e .   A n   a l t e r n a t i v e   a p p r o a c h   i s   t o   a d d   a   N o d e   l a b e l   f o r   e a c h   p r o f i l e   ( o r   c l a s s   o f   p r o f i l e s )   o n   t h e   N o d e ,   a n d   u s e   a   n o d e   s e l e c t o r   t o   e n s u r e   t h e   P o d   i s   r u n   o n   a   N o d e   w i t h   t h e   r e q u i r e d   p r o f i l e .


Question: What is Authoring Profiles?

Answer: G e t t i n g   A p p A r m o r   p r o f i l e s   s p e c i f i e d   c o r r e c t l y   c a n   b e   a   t r i c k y   b u s i n e s s .   F o r t u n a t e l y   t h e r e   a r e   s o m e   t o o l s   t o   h e l p   w i t h   t h a t :   a a - g e n p r o f   a n d   a a - l o g p r o f   g e n e r a t e   p r o f i l e   r u l e s   b y   m o n i t o r i n g   a n   a p p l i c a t i o n ' s   a c t i v i t y   a n d   l o g s ,   a n d   a d m i t t i n g   t h e   a c t i o n s   i t   t a k e s .   F u r t h e r   i n s t r u c t i o n s   a r e   p r o v i d e d   b y   t h e   A p p A r m o r   d o c u m e n t a t i o n . b a n e   i s   a n   A p p A r m o r   p r o f i l e   g e n e r a t o r   f o r   D o c k e r   t h a t   u s e s   a   s i m p l i f i e d   p r o f i l e   l a n g u a g e .   T o   d e b u g   p r o b l e m s   w i t h   A p p A r m o r ,   y o u   c a n   c h e c k   t h e   s y s t e m   l o g s   t o   s e e   w h a t ,   s p e c i f i c a l l y ,   w a s   d e n i e d .   A p p A r m o r   l o g s   v e r b o s e   m e s s a g e s   t o   d m e s g ,   a n d   e r r o r s   c a n   u s u a l l y   b e   f o u n d   i n   t h e   s y s t e m   l o g s   o r   t h r o u g h   j o u r n a l c t l .   M o r e   i n f o r m a t i o n   i s   p r o v i d e d   i n   A p p A r m o r   f a i l u r e s .


Question: What is AppArmor profile within security context?

Answer: Y o u   c a n   s p e c i f y   t h e   a p p A r m o r P r o f i l e   o n   e i t h e r   a   c o n t a i n e r ' s   s e c u r i t y C o n t e x t   o r   o n   a   P o d ' s   s e c u r i t y C o n t e x t .   I f   t h e   p r o f i l e   i s   s e t   a t   t h e   p o d   l e v e l ,   i t   w i l l   b e   u s e d   a s   t h e   d e f a u l t   p r o f i l e   f o r   a l l   c o n t a i n e r s   i n   t h e   p o d   ( i n c l u d i n g   i n i t ,   s i d e c a r ,   a n d   e p h e m e r a l   c o n t a i n e r s ) .   I f   b o t h   a   p o d   &   c o n t a i n e r   A p p A r m o r   p r o f i l e   a r e   s e t ,   t h e   c o n t a i n e r ' s   p r o f i l e   w i l l   b e   u s e d .   A n   A p p A r m o r   p r o f i l e   h a s   2   f i e l d s :   t y p e   ( r e q u i r e d )   -   i n d i c a t e s   w h i c h   k i n d   o f   A p p A r m o r   p r o f i l e   w i l l   b e   a p p l i e d .   V a l i d   o p t i o n s   a r e :   l o c a l h o s t P r o f i l e   -   T h e   n a m e   o f   a   p r o f i l e   l o a d e d   o n   t h e   n o d e   t h a t   s h o u l d   b e   u s e d .   T h e   p r o f i l e   m u s t   b e   p r e c o n f i g u r e d   o n   t h e   n o d e   t o   w o r k .   T h i s   o p t i o n   m u s t   b e   p r o v i d e d   i f   a n d   o n l y   i f   t h e   t y p e   i s   L o c a l h o s t .


Question: What is What's next?

Answer: A d d i t i o n a l   r e s o u r c e s :   Q u i c k   g u i d e   t o   t h e   A p p A r m o r   p r o f i l e   l a n g u a g e A p p A r m o r   c o r e   p o l i c y   r e f e r e n c e


Question: What is Storage?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.StorageWays to provide both long-term and temporary storage to Pods in your cluster.1: Volumes2: Persistent Volumes3: Projected Volumes4: Ephemeral Volumes5: Storage Classes6: Volume Attributes Classes7: Dynamic Volume Provisioning8: Volume Snapshots9: Volume Snapshot Classes10: CSI Volume Cloning11: Storage Capacity12: Node-specific Volume Limits13: Volume Health Monitoring14: Windows Storage1 - VolumesKubernetes volumes provide a way for containers in a pod to access and share data via the filesystem. There are different kinds of volume that you can use for different purposes, such as:populating a configuration file based on a ConfigMap or a Secretproviding some temporary scratch space for a podsharing a filesystem between two different containers in the same podsharing a filesystem between two different pods (even if those Pods run on different nodes)durably storing data so that it stays available even if the Pod restarts or is replacedpassing configuration information to an app running in a container, based on details of the Pod the container is in (for example: telling a sidecar container what namespace the Pod is running in)providing read-only access to data in a different container imageData sharing can be between different local processes within a container, or between different containers, or between Pods.Why volumes are importantData persistence: On-disk files in a container are ephemeral, which presents some problems for non-trivial applications when running in containers. One problem occurs when a container crashes or is stopped, the container state is not saved so all of the files that were created or modified during the lifetime of the container are lost. After a crash, kubelet restarts the container with a clean state.Shared storage: Another problem occurs when multiple containers are running in a Pod and need to share files. It can be challenging to set up and access a shared filesystem across all of the containers.The Kubernetes volume abstraction can help you to solve both of these problems.Before you learn about volumes, PersistentVolumes and PersistentVolumeClaims, you should read up about Pods and make sure that you understand how Kubernetes uses Pods to run containers.How volumes workKubernetes supports many types of volumes. A Pod can use any number of volume types simultaneously. Ephemeral volume types have a lifetime linked to a specific Pod, but persistent volumes exist beyond the lifetime of any individual pod. When a pod ceases to exist, Kubernetes destroys ephemeral volumes; however, Kubernetes does not destroy persistent volumes. For any kind of volume in a given pod, data is preserved across container restarts.At its core, a volume is a directory, possibly with some data in it, which is accessible to the containers in a pod. How that directory comes to be, the medium that backs it, and the contents of i


Question: How does Storage work?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.StorageWays to provide both long-term and temporary storage to Pods in your cluster.1: Volumes2: Persistent Volumes3: Projected Volumes4: Ephemeral Volumes5: Storage Classes6: Volume Attributes Classes7: Dynamic Volume Provisioning8: Volume Snapshots9: Volume Snapshot Classes10: CSI Volume Cloning11: Storage Capacity12: Node-specific Volume Limits13: Volume Health Monitoring14: Windows Storage1 - VolumesKubernetes volumes provide a way for containers in a pod to access and share data via the filesystem. There are different kinds of volume that you can use for different purposes, such as:populating a configuration file based on a ConfigMap or a Secretproviding some temporary scratch space for a podsharing a filesystem between two different containers in the same podsharing a filesystem between two different pods (even if those Pods run on different nodes)durably storing data so that it stays available even if the Pod restarts or is replacedpassing configuration information to an app running in a container, based on details of the Pod the container is in (for example: telling a sidecar container what namespace the Pod is running in)providing read-only access to data in a different container imageData sharing can be between different local processes within a container, or between different containers, or between Pods.Why volumes are importantData persistence: On-disk files in a container are ephemeral, which presents some problems for non-trivial applications when running in containers. One problem occurs when a container crashes or is stopped, the container state is not saved so all of the files that were created or modified during the lifetime of the container are lost. After a crash, kubelet restarts the container with a clean state.Shared storage: Another problem occurs when multiple containers are running in a Pod and need to share files. It can be challenging to set up and access a shared filesystem across all of the containers.The Kubernetes volume abstraction can help you to solve both of these problems.Before you learn about volumes, PersistentVolumes and PersistentVolumeClaims, you should read up about Pods and make sure that you understand how Kubernetes uses Pods to run containers.How volumes workKubernetes supports many types of volumes. A Pod can use any number of volume types simultaneously. Ephemeral volume types have a lifetime linked to a specific Pod, but persistent volumes exist beyond the lifetime of any individual pod. When a pod ceases to exist, Kubernetes destroys ephemeral volumes; however, Kubernetes does not destroy persistent volumes. For any kind of volume in a given pod, data is preserved across container restarts.At its core, a volume is a directory, possibly with some data in it, which is accessible to the containers in a pod. How that directory comes to be, the medium that backs it, and the contents of i


Question: When would you use Storage?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.StorageWays to provide both long-term and temporary storage to Pods in your cluster.1: Volumes2: Persistent Volumes3: Projected Volumes4: Ephemeral Volumes5: Storage Classes6: Volume Attributes Classes7: Dynamic Volume Provisioning8: Volume Snapshots9: Volume Snapshot Classes10: CSI Volume Cloning11: Storage Capacity12: Node-specific Volume Limits13: Volume Health Monitoring14: Windows Storage1 - VolumesKubernetes volumes provide a way for containers in a pod to access and share data via the filesystem. There are different kinds of volume that you can use for different purposes, such as:populating a configuration file based on a ConfigMap or a Secretproviding some temporary scratch space for a podsharing a filesystem between two different containers in the same podsharing a filesystem between two different pods (even if those Pods run on different nodes)durably storing data so that it stays available even if the Pod restarts or is replacedpassing configuration information to an app running in a container, based on details of the Pod the container is in (for example: telling a sidecar container what namespace the Pod is running in)providing read-only access to data in a different container imageData sharing can be between different local processes within a container, or between different containers, or between Pods.Why volumes are importantData persistence: On-disk files in a container are ephemeral, which presents some problems for non-trivial applications when running in containers. One problem occurs when a container crashes or is stopped, the container state is not saved so all of the files that were created or modified during the lifetime of the container are lost. After a crash, kubelet restarts the container with a clean state.Shared storage: Another problem occurs when multiple containers are running in a Pod and need to share files. It can be challenging to set up and access a shared filesystem across all of the containers.The Kubernetes volume abstraction can help you to solve both of these problems.Before you learn about volumes, PersistentVolumes and PersistentVolumeClaims, you should read up about Pods and make sure that you understand how Kubernetes uses Pods to run containers.How volumes workKubernetes supports many types of volumes. A Pod can use any number of volume types simultaneously. Ephemeral volume types have a lifetime linked to a specific Pod, but persistent volumes exist beyond the lifetime of any individual pod. When a pod ceases to exist, Kubernetes destroys ephemeral volumes; however, Kubernetes does not destroy persistent volumes. For any kind of volume in a given pod, data is preserved across container restarts.At its core, a volume is a directory, possibly with some data in it, which is accessible to the containers in a pod. How that directory comes to be, the medium that backs it, and the contents of i


Question: What are the benefits of Storage?

Answer: This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.StorageWays to provide both long-term and temporary storage to Pods in your cluster.1: Volumes2: Persistent Volumes3: Projected Volumes4: Ephemeral Volumes5: Storage Classes6: Volume Attributes Classes7: Dynamic Volume Provisioning8: Volume Snapshots9: Volume Snapshot Classes10: CSI Volume Cloning11: Storage Capacity12: Node-specific Volume Limits13: Volume Health Monitoring14: Windows Storage1 - VolumesKubernetes volumes provide a way for containers in a pod to access and share data via the filesystem. There are different kinds of volume that you can use for different purposes, such as:populating a configuration file based on a ConfigMap or a Secretproviding some temporary scratch space for a podsharing a filesystem between two different containers in the same podsharing a filesystem between two different pods (even if those Pods run on different nodes)durably storing data so that it stays available even if the Pod restarts or is replacedpassing configuration information to an app running in a container, based on details of the Pod the container is in (for example: telling a sidecar container what namespace the Pod is running in)providing read-only access to data in a different container imageData sharing can be between different local processes within a container, or between different containers, or between Pods.Why volumes are importantData persistence: On-disk files in a container are ephemeral, which presents some problems for non-trivial applications when running in containers. One problem occurs when a container crashes or is stopped, the container state is not saved so all of the files that were created or modified during the lifetime of the container are lost. After a crash, kubelet restarts the container with a clean state.Shared storage: Another problem occurs when multiple containers are running in a Pod and need to share files. It can be challenging to set up and access a shared filesystem across all of the containers.The Kubernetes volume abstraction can help you to solve both of these problems.Before you learn about volumes, PersistentVolumes and PersistentVolumeClaims, you should read up about Pods and make sure that you understand how Kubernetes uses Pods to run containers.How volumes workKubernetes supports many types of volumes. A Pod can use any number of volume types simultaneously. Ephemeral volume types have a lifetime linked to a specific Pod, but persistent volumes exist beyond the lifetime of any individual pod. When a pod ceases to exist, Kubernetes destroys ephemeral volumes; however, Kubernetes does not destroy persistent volumes. For any kind of volume in a given pod, data is preserved across container restarts.At its core, a volume is a directory, possibly with some data in it, which is accessible to the containers in a pod. How that directory comes to be, the medium that backs it, and the contents of i


Question: What is Storage?

Answer: 1 :   V o l u m e s 2 :   P e r s i s t e n t   V o l u m e s 3 :   P r o j e c t e d   V o l u m e s 4 :   E p h e m e r a l   V o l u m e s 5 :   S t o r a g e   C l a s s e s 6 :   V o l u m e   A t t r i b u t e s   C l a s s e s 7 :   D y n a m i c   V o l u m e   P r o v i s i o n i n g 8 :   V o l u m e   S n a p s h o t s 9 :   V o l u m e   S n a p s h o t   C l a s s e s 1 0 :   C S I   V o l u m e   C l o n i n g 1 1 :   S t o r a g e   C a p a c i t y 1 2 :   N o d e - s p e c i f i c   V o l u m e   L i m i t s 1 3 :   V o l u m e   H e a l t h   M o n i t o r i n g 1 4 :   W i n d o w s   S t o r a g e


Question: What is 1 - Volumes?

Answer: K u b e r n e t e s   v o l u m e s   p r o v i d e   a   w a y   f o r   c o n t a i n e r s   i n   a   p o d   t o   a c c e s s   a n d   s h a r e   d a t a   v i a   t h e   f i l e s y s t e m .   T h e r e   a r e   d i f f e r e n t   k i n d s   o f   v o l u m e   t h a t   y o u   c a n   u s e   f o r   d i f f e r e n t   p u r p o s e s ,   s u c h   a s :   p o p u l a t i n g   a   c o n f i g u r a t i o n   f i l e   b a s e d   o n   a   C o n f i g M a p   o r   a   S e c r e t p r o v i d i n g   s o m e   t e m p o r a r y   s c r a t c h   s p a c e   f o r   a   p o d s h a r i n g   a   f i l e s y s t e m   b e t w e e n   t w o   d i f f e r e n t   c o n t a i n e r s   i n   t h e   s a m e   p o d s h a r i n g   a   f i l e s y s t e m   b e t w e e n   t w o   d i f f e r e n t   p o d s   ( e v e n   i f   t h o s e   P o d s   r u n   o n   d i f f e r e n t   n o d e s ) d u r a b l y   s t o r i n g   d a t a   s o   t h a t   i t   s t a y s   a v a i l a b l e   e v e n   i f   t h e   P o d   r e s t a r t s   o r   i s   r e p l a c e d p a s s i n g   c o n f i g u r a t i o n   i n f o r m a t i o n   t o   a n   a p p   r u n n i n g   i n   a   c o n t a i n e r ,   b a s e d   o n   d e t a i l s   o f   t h e   P o d   t h e   c o n t a i n e r   i s   i n   ( f o r   e x a m p l e :   t e l l i n g   a   s i d e c a r   c o n t a i n e r   w h a t   n a m e s p a c e   t h e   P o d   i s   r u n n i n g   i n ) p r o v i d i n g   r e a d - o n l y   a c c e s s   t o   d a t a   i n   a   d i f f e r e n t   c o n t a i n e r   i m a g e   D a t a   s h a r i n g   c a n   b e   b e t w e e n   d i f f e r e n t   l o c a l   p r o c e s s e s   w i t h i n   a   c o n t a i n e r ,   o r   b e t w e e n   d i f f e r e n t   c o n t a i n e r s ,   o r   b e t w e e n   P o d s .


Question: What is Why volumes are important?

Answer: D a t a   p e r s i s t e n c e :   O n - d i s k   f i l e s   i n   a   c o n t a i n e r   a r e   e p h e m e r a l ,   w h i c h   p r e s e n t s   s o m e   p r o b l e m s   f o r   n o n - t r i v i a l   a p p l i c a t i o n s   w h e n   r u n n i n g   i n   c o n t a i n e r s .   O n e   p r o b l e m   o c c u r s   w h e n   a   c o n t a i n e r   c r a s h e s   o r   i s   s t o p p e d ,   t h e   c o n t a i n e r   s t a t e   i s   n o t   s a v e d   s o   a l l   o f   t h e   f i l e s   t h a t   w e r e   c r e a t e d   o r   m o d i f i e d   d u r i n g   t h e   l i f e t i m e   o f   t h e   c o n t a i n e r   a r e   l o s t .   A f t e r   a   c r a s h ,   k u b e l e t   r e s t a r t s   t h e   c o n t a i n e r   w i t h   a   c l e a n   s t a t e . S h a r e d   s t o r a g e :   A n o t h e r   p r o b l e m   o c c u r s   w h e n   m u l t i p l e   c o n t a i n e r s   a r e   r u n n i n g   i n   a   P o d   a n d   n e e d   t o   s h a r e   f i l e s .   I t   c a n   b e   c h a l l e n g i n g   t o   s e t   u p   a n d   a c c e s s   a   s h a r e d   f i l e s y s t e m   a c r o s s   a l l   o f   t h e   c o n t a i n e r s .   D a t a   p e r s i s t e n c e :   O n - d i s k   f i l e s   i n   a   c o n t a i n e r   a r e   e p h e m e r a l ,   w h i c h   p r e s e n t s   s o m e   p r o b l e m s   f o r   n o n - t r i v i a l   a p p l i c a t i o n s   w h e n   r u n n i n g   i n   c o n t a i n e r s .   O n e   p r o b l e m   o c c u r s   w h e n   a   c o n t a i n e r   c r a s h e s   o r   i s   s t o p p e d ,   t h e   c o n t a i n e r   s t a t e   i s   n o t   s a v e d   s o   a l l   o f   t h e   f i l e s   t h a t   w e r e   c r e a t e d   o r   m o d i f i e d   d u r i n g   t h e   l i f e t i m e   o f   t h e   c o n t a i n e r   a r e   l o s t .   A f t e r   a   c r a s h ,   k u b e l e t   r e s t a r t s   t h e   c o n t a i n e r   w i t h   a   c l e a n


Question: What is How volumes work?

Answer: K u b e r n e t e s   s u p p o r t s   m a n y   t y p e s   o f   v o l u m e s .   A   P o d   c a n   u s e   a n y   n u m b e r   o f   v o l u m e   t y p e s   s i m u l t a n e o u s l y .   E p h e m e r a l   v o l u m e   t y p e s   h a v e   a   l i f e t i m e   l i n k e d   t o   a   s p e c i f i c   P o d ,   b u t   p e r s i s t e n t   v o l u m e s   e x i s t   b e y o n d   t h e   l i f e t i m e   o f   a n y   i n d i v i d u a l   p o d .   W h e n   a   p o d   c e a s e s   t o   e x i s t ,   K u b e r n e t e s   d e s t r o y s   e p h e m e r a l   v o l u m e s ;   h o w e v e r ,   K u b e r n e t e s   d o e s   n o t   d e s t r o y   p e r s i s t e n t   v o l u m e s .   F o r   a n y   k i n d   o f   v o l u m e   i n   a   g i v e n   p o d ,   d a t a   i s   p r e s e r v e d   a c r o s s   c o n t a i n e r   r e s t a r t s .   A t   i t s   c o r e ,   a   v o l u m e   i s   a   d i r e c t o r y ,   p o s s i b l y   w i t h   s o m e   d a t a   i n   i t ,   w h i c h   i s   a c c e s s i b l e   t o   t h e   c o n t a i n e r s   i n   a   p o d .   H o w   t h a t   d i r e c t o r y   c o m e s   t o   b e ,   t h e   m e d i u m   t h a t   b a c k s   i t ,   a n d   t h e   c o n t e n t s   o f   i t   a r e   d e t e r m i n e d   b y   t h e   p a r t i c u l a r   v o l u m e   t y p e   u s e d .   T o   u s e   a   v o l u m e ,   s p e c i f y   t h e   v o l u m e s   t o   p r o v i d e   f o r   t h e   P o d   i n   . s p e c . v o l u m e s   a n d   d e c l a r e   w h e r e   t o   m o u n t   t h o s e   v o l u m e s   i n t o   c o n t a i n e r s   i n   . s p e c . c o n t a i n e r s [ * ] . v o l u m e M o u n t s .   W h e n   a   p o d   i s   l a u n c h e d ,   a   p r o c e s s   i n   t h e   c o n t a i n e r   s e e s   a   f i l e s y s t e m   v i e w   c o m p o s e d   f r o m   t h e   i n i t i a l   c o n t e n t s   o f   t h e   c o n t a i n e r   i m a g e ,   p l


Question: What is Types of volumes?

Answer: K u b e r n e t e s   s u p p o r t s   s e v e r a l   t y p e s   o f   v o l u m e s .


Question: What is awsElasticBlockStore (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   a w s E l a s t i c B l o c k S t o r e   t y p e   a r e   r e d i r e c t e d   t o   t h e   e b s . c s i . a w s . c o m   C S I   d r i v e r .   T h e   A W S E l a s t i c B l o c k S t o r e   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 1 9   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 2 7   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   A W S   E B S   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is azureDisk (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   a z u r e D i s k   t y p e   a r e   r e d i r e c t e d   t o   t h e   d i s k . c s i . a z u r e . c o m   C S I   d r i v e r .   T h e   A z u r e D i s k   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 1 9   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 2 7   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   A z u r e   D i s k   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is azureFile (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   a z u r e F i l e   t y p e   a r e   r e d i r e c t e d   t o   t h e   f i l e . c s i . a z u r e . c o m   C S I   d r i v e r .   T h e   A z u r e F i l e   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 2 1   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 3 0   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   A z u r e   F i l e   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is cephfs (removed)?

Answer: K u b e r n e t e s   1 . 3 4   d o e s   n o t   i n c l u d e   a   c e p h f s   v o l u m e   t y p e .   T h e   c e p h f s   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 2 8   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 3 1   r e l e a s e .


Question: What is cinder (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   c i n d e r   t y p e   a r e   r e d i r e c t e d   t o   t h e   c i n d e r . c s i . o p e n s t a c k . o r g   C S I   d r i v e r .   T h e   O p e n S t a c k   C i n d e r   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 1 1   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 2 6   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   O p e n S t a c k   C i n d e r   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is configMap?

Answer: A   C o n f i g M a p   p r o v i d e s   a   w a y   t o   i n j e c t   c o n f i g u r a t i o n   d a t a   i n t o   p o d s .   T h e   d a t a   s t o r e d   i n   a   C o n f i g M a p   c a n   b e   r e f e r e n c e d   i n   a   v o l u m e   o f   t y p e   c o n f i g M a p   a n d   t h e n   c o n s u m e d   b y   c o n t a i n e r i z e d   a p p l i c a t i o n s   r u n n i n g   i n   a   p o d .   W h e n   r e f e r e n c i n g   a   C o n f i g M a p ,   y o u   p r o v i d e   t h e   n a m e   o f   t h e   C o n f i g M a p   i n   t h e   v o l u m e .   Y o u   c a n   c u s t o m i z e   t h e   p a t h   t o   u s e   f o r   a   s p e c i f i c   e n t r y   i n   t h e   C o n f i g M a p .   T h e   f o l l o w i n g   c o n f i g u r a t i o n   s h o w s   h o w   t o   m o u n t   t h e   l o g - c o n f i g   C o n f i g M a p   o n t o   a   P o d   c a l l e d   c o n f i g m a p - p o d :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   c o n f i g m a p - p o d   s p e c :   c o n t a i n e r s :   -   n a m e :   t e s t   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [ ' s h ' ,   ' - c ' ,   ' e c h o   " T h e   a p p   i s   r u n n i n g ! "   & &   t a i l   - f   / d e v / n u l l ' ]   v o l u m e M o u n t s :   -   n a m e :   c o n f i g - v o l   m o u n t P a t h :   / e t c / c o n f i g   v o l u m e s :   -   n a m e :   c o n f i g - v o l   c o n f i g M a p :   n a m e :   l o g - c o n f i g   i t e m s :   -   k e y :   l o g _ l e v e l   p a t h :   l o g _ l e v e l . c o n f   T h e   l o g - c o n f i g   C o n f i g M a p   i s   m o u n t e d   a s   a   v o l u m e ,   a n d   a l l   c o n t e n t s   s t o r e d   i n   i t s   l o g _ l e v e l   e n t r y   a r e   m o u n t e d   i n t o   t h e   P o d   a t   p a t h   / e t c / c o n f i g / l o g _ l e v e l . c o n f .   N o t e   t h a t   t h i s   p a t h   i s   d e r i v e d   f r o


Question: What is Note:?

Answer: Y o u   m u s t   c r e a t e   a   C o n f i g M a p   b e f o r e   y o u   c a n   u s e   i t . A   C o n f i g M a p   i s   a l w a y s   m o u n t e d   a s   r e a d O n l y . A   c o n t a i n e r   u s i n g   a   C o n f i g M a p   a s   a   s u b P a t h   v o l u m e   m o u n t   w i l l   n o t   r e c e i v e   u p d a t e s   w h e n   t h e   C o n f i g M a p   c h a n g e s . T e x t   d a t a   i s   e x p o s e d   a s   f i l e s   u s i n g   t h e   U T F - 8   c h a r a c t e r   e n c o d i n g .   F o r   o t h e r   c h a r a c t e r   e n c o d i n g s ,   u s e   b i n a r y D a t a .   Y o u   m u s t   c r e a t e   a   C o n f i g M a p   b e f o r e   y o u   c a n   u s e   i t .   A   C o n f i g M a p   i s   a l w a y s   m o u n t e d   a s   r e a d O n l y .   A   c o n t a i n e r   u s i n g   a   C o n f i g M a p   a s   a   s u b P a t h   v o l u m e   m o u n t   w i l l   n o t   r e c e i v e   u p d a t e s   w h e n   t h e   C o n f i g M a p   c h a n g e s .   T e x t   d a t a   i s   e x p o s e d   a s   f i l e s   u s i n g   t h e   U T F - 8   c h a r a c t e r   e n c o d i n g .   F o r   o t h e r   c h a r a c t e r   e n c o d i n g s ,   u s e   b i n a r y D a t a .


Question: What is downwardAPI?

Answer: A   d o w n w a r d A P I   v o l u m e   m a k e s   d o w n w a r d   A P I   d a t a   a v a i l a b l e   t o   a p p l i c a t i o n s .   W i t h i n   t h e   v o l u m e ,   y o u   c a n   f i n d   t h e   e x p o s e d   d a t a   a s   r e a d - o n l y   f i l e s   i n   p l a i n   t e x t   f o r m a t .


Question: What is Note:?

Answer: S e e   E x p o s e   P o d   I n f o r m a t i o n   t o   C o n t a i n e r s   T h r o u g h   F i l e s   t o   l e a r n   m o r e .


Question: What is emptyDir?

Answer: F o r   a   P o d   t h a t   d e f i n e s   a n   e m p t y D i r   v o l u m e ,   t h e   v o l u m e   i s   c r e a t e d   w h e n   t h e   P o d   i s   a s s i g n e d   t o   a   n o d e .   A s   t h e   n a m e   s a y s ,   t h e   e m p t y D i r   v o l u m e   i s   i n i t i a l l y   e m p t y .   A l l   c o n t a i n e r s   i n   t h e   P o d   c a n   r e a d   a n d   w r i t e   t h e   s a m e   f i l e s   i n   t h e   e m p t y D i r   v o l u m e ,   t h o u g h   t h a t   v o l u m e   c a n   b e   m o u n t e d   a t   t h e   s a m e   o r   d i f f e r e n t   p a t h s   i n   e a c h   c o n t a i n e r .   W h e n   a   P o d   i s   r e m o v e d   f r o m   a   n o d e   f o r   a n y   r e a s o n ,   t h e   d a t a   i n   t h e   e m p t y D i r   i s   d e l e t e d   p e r m a n e n t l y .


Question: What is Note:?

Answer: S o m e   u s e s   f o r   a n   e m p t y D i r   a r e :   s c r a t c h   s p a c e ,   s u c h   a s   f o r   a   d i s k - b a s e d   m e r g e   s o r t c h e c k p o i n t i n g   a   l o n g   c o m p u t a t i o n   f o r   r e c o v e r y   f r o m   c r a s h e s h o l d i n g   f i l e s   t h a t   a   c o n t e n t - m a n a g e r   c o n t a i n e r   f e t c h e s   w h i l e   a   w e b s e r v e r   c o n t a i n e r   s e r v e s   t h e   d a t a   T h e   e m p t y D i r . m e d i u m   f i e l d   c o n t r o l s   w h e r e   e m p t y D i r   v o l u m e s   a r e   s t o r e d .   B y   d e f a u l t   e m p t y D i r   v o l u m e s   a r e   s t o r e d   o n   w h a t e v e r   m e d i u m   t h a t   b a c k s   t h e   n o d e   s u c h   a s   d i s k ,   S S D ,   o r   n e t w o r k   s t o r a g e ,   d e p e n d i n g   o n   y o u r   e n v i r o n m e n t .   I f   y o u   s e t   t h e   e m p t y D i r . m e d i u m   f i e l d   t o   " M e m o r y " ,   K u b e r n e t e s   m o u n t s   a   t m p f s   ( R A M - b a c k e d   f i l e s y s t e m )   f o r   y o u   i n s t e a d .   W h i l e   t m p f s   i s   v e r y   f a s t ,   b e   a w a r e   t h a t ,   u n l i k e   d i s k s ,   f i l e s   y o u   w r i t e   c o u n t   a g a i n s t   t h e   m e m o r y   l i m i t   o f   t h e   c o n t a i n e r   t h a t   w r o t e   t h e m .   A   s i z e   l i m i t   c a n   b e   s p e c i f i e d   f o r   t h e   d e f a u l t   m e d i u m ,   w h i c h   l i m i t s   t h e   c a p a c i t y   o f   t h e   e m p t y D i r   v o l u m e .   T h e   s t o r a g e   i s   a l l o c a t e d   f r o m   n o d e   e p h e m e r a l   s t o r a g e .   I f   t h a t   i s   f i l l e d   u p   f r o m   a n o t h e r   s o u r c e   ( f o r   e x a m p l e ,   l o g   f i l e s   o r   i m a g e   o v e r l a y s ) ,   t h e   e m p t y D i r   m a y   r u n   o u t   o f   c a p a c i t y   b e f o r e   t h i s


Question: What is emptyDir configuration example?

Answer: a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - p d   s p e c :   c o n t a i n e r s :   -   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r   n a m e :   t e s t - c o n t a i n e r   v o l u m e M o u n t s :   -   m o u n t P a t h :   / c a c h e   n a m e :   c a c h e - v o l u m e   v o l u m e s :   -   n a m e :   c a c h e - v o l u m e   e m p t y D i r :   s i z e L i m i t :   5 0 0 M i


Question: What is emptyDir memory configuration example?

Answer: a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - p d   s p e c :   c o n t a i n e r s :   -   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r   n a m e :   t e s t - c o n t a i n e r   v o l u m e M o u n t s :   -   m o u n t P a t h :   / c a c h e   n a m e :   c a c h e - v o l u m e   v o l u m e s :   -   n a m e :   c a c h e - v o l u m e   e m p t y D i r :   s i z e L i m i t :   5 0 0 M i   m e d i u m :   M e m o r y


Question: What is fc (fibre channel)?

Answer: A n   f c   v o l u m e   t y p e   a l l o w s   a n   e x i s t i n g   f i b r e   c h a n n e l   b l o c k   s t o r a g e   v o l u m e   t o   b e   m o u n t e d   i n   a   P o d .   Y o u   c a n   s p e c i f y   s i n g l e   o r   m u l t i p l e   t a r g e t   w o r l d   w i d e   n a m e s   ( W W N s )   u s i n g   t h e   p a r a m e t e r   t a r g e t W W N s   i n   y o u r   V o l u m e   c o n f i g u r a t i o n .   I f   m u l t i p l e   W W N s   a r e   s p e c i f i e d ,   t a r g e t W W N s   e x p e c t   t h a t   t h o s e   W W N s   a r e   f r o m   m u l t i - p a t h   c o n n e c t i o n s .


Question: What is gcePersistentDisk (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   g c e P e r s i s t e n t D i s k   t y p e   a r e   r e d i r e c t e d   t o   t h e   p d . c s i . s t o r a g e . g k e . i o   C S I   d r i v e r .   T h e   g c e P e r s i s t e n t D i s k   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 1 7   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 2 8   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   G o o g l e   C o m p u t e   E n g i n e   P e r s i s t e n t   D i s k   C S I   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is Warning:?

Answer: T h e   g i t R e p o   v o l u m e   p l u g i n   i s   d e p r e c a t e d   a n d   i s   d i s a b l e d   b y   d e f a u l t .   T o   p r o v i s i o n   a   P o d   t h a t   h a s   a   G i t   r e p o s i t o r y   m o u n t e d ,   y o u   c a n   m o u n t   a n   e m p t y D i r   v o l u m e   i n t o   a n   i n i t   c o n t a i n e r   t h a t   c l o n e s   t h e   r e p o   u s i n g   G i t ,   t h e n   m o u n t   t h e   E m p t y D i r   i n t o   t h e   P o d ' s   c o n t a i n e r .   Y o u   c a n   r e s t r i c t   t h e   u s e   o f   g i t R e p o   v o l u m e s   i n   y o u r   c l u s t e r   u s i n g   p o l i c i e s ,   s u c h   a s   V a l i d a t i n g A d m i s s i o n P o l i c y .   Y o u   c a n   u s e   t h e   f o l l o w i n g   C o m m o n   E x p r e s s i o n   L a n g u a g e   ( C E L )   e x p r e s s i o n   a s   p a r t   o f   a   p o l i c y   t o   r e j e c t   u s e   o f   g i t R e p o   v o l u m e s :   ! h a s ( o b j e c t . s p e c . v o l u m e s )   | |   ! o b j e c t . s p e c . v o l u m e s . e x i s t s ( v ,   h a s ( v . g i t R e p o ) )   Y o u   c a n   u s e   t h i s   d e p r e c a t e d   s t o r a g e   p l u g i n   i n   y o u r   c l u s t e r   i f   y o u   e x p l i c i t l y   e n a b l e   t h e   G i t R e p o V o l u m e D r i v e r   f e a t u r e   g a t e .   A   g i t R e p o   v o l u m e   i s   a n   e x a m p l e   o f   a   v o l u m e   p l u g i n .   T h i s   p l u g i n   m o u n t s   a n   e m p t y   d i r e c t o r y   a n d   c l o n e s   a   g i t   r e p o s i t o r y   i n t o   t h i s   d i r e c t o r y   f o r   y o u r   P o d   t o   u s e .   H e r e   i s   a n   e x a m p l e   o f   a   g i t R e p o   v o l u m e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   s e r v e r   s p e c :   c o n t a i n e r s :   -   i m a g e :   n g i n x   n a m e :   n g i n x   v o l u m e M o u n t s :   -


Question: What is glusterfs (removed)?

Answer: K u b e r n e t e s   1 . 3 4   d o e s   n o t   i n c l u d e   a   g l u s t e r f s   v o l u m e   t y p e .   T h e   G l u s t e r F S   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 2 5   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 2 6   r e l e a s e .


Question: What is hostPath?

Answer: A   h o s t P a t h   v o l u m e   m o u n t s   a   f i l e   o r   d i r e c t o r y   f r o m   t h e   h o s t   n o d e ' s   f i l e s y s t e m   i n t o   y o u r   P o d .   T h i s   i s   n o t   s o m e t h i n g   t h a t   m o s t   P o d s   w i l l   n e e d ,   b u t   i t   o f f e r s   a   p o w e r f u l   e s c a p e   h a t c h   f o r   s o m e   a p p l i c a t i o n s .


Question: What is Warning:?

Answer: U s i n g   t h e   h o s t P a t h   v o l u m e   t y p e   p r e s e n t s   m a n y   s e c u r i t y   r i s k s .   I f   y o u   c a n   a v o i d   u s i n g   a   h o s t P a t h   v o l u m e ,   y o u   s h o u l d .   F o r   e x a m p l e ,   d e f i n e   a   l o c a l   P e r s i s t e n t V o l u m e ,   a n d   u s e   t h a t   i n s t e a d .   I f   y o u   a r e   r e s t r i c t i n g   a c c e s s   t o   s p e c i f i c   d i r e c t o r i e s   o n   t h e   n o d e   u s i n g   a d m i s s i o n - t i m e   v a l i d a t i o n ,   t h a t   r e s t r i c t i o n   i s   o n l y   e f f e c t i v e   w h e n   y o u   a d d i t i o n a l l y   r e q u i r e   t h a t   a n y   m o u n t s   o f   t h a t   h o s t P a t h   v o l u m e   a r e   r e a d   o n l y .   I f   y o u   a l l o w   a   r e a d - w r i t e   m o u n t   o f   a n y   h o s t   p a t h   b y   a n   u n t r u s t e d   P o d ,   t h e   c o n t a i n e r s   i n   t h a t   P o d   m a y   b e   a b l e   t o   s u b v e r t   t h e   r e a d - w r i t e   h o s t   m o u n t .   T a k e   c a r e   w h e n   u s i n g   h o s t P a t h   v o l u m e s ,   w h e t h e r   t h e s e   a r e   m o u n t e d   a s   r e a d - o n l y   o r   a s   r e a d - w r i t e ,   b e c a u s e :   A c c e s s   t o   t h e   h o s t   f i l e s y s t e m   c a n   e x p o s e   p r i v i l e g e d   s y s t e m   c r e d e n t i a l s   ( s u c h   a s   f o r   t h e   k u b e l e t )   o r   p r i v i l e g e d   A P I s   ( s u c h   a s   t h e   c o n t a i n e r   r u n t i m e   s o c k e t )   t h a t   c a n   b e   u s e d   f o r   c o n t a i n e r   e s c a p e   o r   t o   a t t a c k   o t h e r   p a r t s   o f   t h e   c l u s t e r . P o d s   w i t h   i d e n t i c a l   c o n f i g u r a t i o n   ( s u c h   a s   c r e a t e d   f r o m   a   P o d T e m p l a t e )   m a y   b e h a v e   d i f f e r e n t l y   o n   d i f f e r e n t   n o d e s


Question: What is hostPath volume types?

Answer: I n   a d d i t i o n   t o   t h e   r e q u i r e d   p a t h   p r o p e r t y ,   y o u   c a n   o p t i o n a l l y   s p e c i f y   a   t y p e   f o r   a   h o s t P a t h   v o l u m e .   T h e   a v a i l a b l e   v a l u e s   f o r   t y p e   a r e :


Question: What is Caution:?

Answer: S o m e   f i l e s   o r   d i r e c t o r i e s   c r e a t e d   o n   t h e   u n d e r l y i n g   h o s t s   m i g h t   o n l y   b e   a c c e s s i b l e   b y   r o o t .   Y o u   t h e n   e i t h e r   n e e d   t o   r u n   y o u r   p r o c e s s   a s   r o o t   i n   a   p r i v i l e g e d   c o n t a i n e r   o r   m o d i f y   t h e   f i l e   p e r m i s s i o n s   o n   t h e   h o s t   t o   r e a d   f r o m   o r   w r i t e   t o   a   h o s t P a t h   v o l u m e .


Question: What is hostPath configuration example?

Answer: - - -   #   T h i s   m a n i f e s t   m o u n t s   / d a t a / f o o   o n   t h e   h o s t   a s   / f o o   i n s i d e   t h e   #   s i n g l e   c o n t a i n e r   t h a t   r u n s   w i t h i n   t h e   h o s t p a t h - e x a m p l e - l i n u x   P o d .   #   #   T h e   m o u n t   i n t o   t h e   c o n t a i n e r   i s   r e a d - o n l y .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   h o s t p a t h - e x a m p l e - l i n u x   s p e c :   o s :   {   n a m e :   l i n u x   }   n o d e S e l e c t o r :   k u b e r n e t e s . i o / o s :   l i n u x   c o n t a i n e r s :   -   n a m e :   e x a m p l e - c o n t a i n e r   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r   v o l u m e M o u n t s :   -   m o u n t P a t h :   / f o o   n a m e :   e x a m p l e - v o l u m e   r e a d O n l y :   t r u e   v o l u m e s :   -   n a m e :   e x a m p l e - v o l u m e   #   m o u n t   / d a t a / f o o ,   b u t   o n l y   i f   t h a t   d i r e c t o r y   a l r e a d y   e x i s t s   h o s t P a t h :   p a t h :   / d a t a / f o o   #   d i r e c t o r y   l o c a t i o n   o n   h o s t   t y p e :   D i r e c t o r y   #   t h i s   f i e l d   i s   o p t i o n a l   - - -   #   T h i s   m a n i f e s t   m o u n t s   / d a t a / f o o   o n   t h e   h o s t   a s   / f o o   i n s i d e   t h e   #   s i n g l e   c o n t a i n e r   t h a t   r u n s   w i t h i n   t h e   h o s t p a t h - e x a m p l e - l i n u x   P o d .   #   #   T h e   m o u n t   i n t o   t h e   c o n t a i n e r   i s   r e a d - o n l y .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   h o s t p a t h - e x a m p l e - l i n u x   s p e c :   o s :   {   n a m e :   l i n u x   }   n o d e S e l e c t o r :   k u b e r n e t e s . i o / o s :   l i n u x   c o n t a i n e r s :   -   n a m e :   e x a m p l e - c o n t a i n e r   i m a g e :


Question: What is hostPath FileOrCreate configuration example?

Answer: T h e   f o l l o w i n g   m a n i f e s t   d e f i n e s   a   P o d   t h a t   m o u n t s   / v a r / l o c a l / a a a   i n s i d e   t h e   s i n g l e   c o n t a i n e r   i n   t h e   P o d .   I f   t h e   n o d e   d o e s   n o t   a l r e a d y   h a v e   a   p a t h   / v a r / l o c a l / a a a ,   t h e   k u b e l e t   c r e a t e s   i t   a s   a   d i r e c t o r y   a n d   t h e n   m o u n t s   i t   i n t o   t h e   P o d .   I f   / v a r / l o c a l / a a a   a l r e a d y   e x i s t s   b u t   i s   n o t   a   d i r e c t o r y ,   t h e   P o d   f a i l s .   A d d i t i o n a l l y ,   t h e   k u b e l e t   a t t e m p t s   t o   m a k e   a   f i l e   n a m e d   / v a r / l o c a l / a a a / 1 . t x t   i n s i d e   t h a t   d i r e c t o r y   ( a s   s e e n   f r o m   t h e   h o s t ) ;   i f   s o m e t h i n g   a l r e a d y   e x i s t s   a t   t h a t   p a t h   a n d   i s n ' t   a   r e g u l a r   f i l e ,   t h e   P o d   f a i l s .   H e r e ' s   t h e   e x a m p l e   m a n i f e s t :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - w e b s e r v e r   s p e c :   o s :   {   n a m e :   l i n u x   }   n o d e S e l e c t o r :   k u b e r n e t e s . i o / o s :   l i n u x   c o n t a i n e r s :   -   n a m e :   t e s t - w e b s e r v e r   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r : l a t e s t   v o l u m e M o u n t s :   -   m o u n t P a t h :   / v a r / l o c a l / a a a   n a m e :   m y d i r   -   m o u n t P a t h :   / v a r / l o c a l / a a a / 1 . t x t   n a m e :   m y f i l e   v o l u m e s :   -   n a m e :   m y d i r   h o s t P a t h :   #   E n s u r e   t h e   f i l e   d i r e c t o r y   i s   c r e a t e d .   p a t h :   / v a r / l o c a l / a a a   t y p e :   D i r e c t o r y O r C r e a t e   -   n a m e :   m y f i l e   h o s t P a t h :   p a t h :   / v a r / l o c a l /


Question: What is image?

Answer: A n   i m a g e   v o l u m e   s o u r c e   r e p r e s e n t s   a n   O C I   o b j e c t   ( a   c o n t a i n e r   i m a g e   o r   a r t i f a c t )   w h i c h   i s   a v a i l a b l e   o n   t h e   k u b e l e t ' s   h o s t   m a c h i n e .   A n   e x a m p l e   o f   u s i n g   t h e   i m a g e   v o l u m e   s o u r c e   i s :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   i m a g e - v o l u m e   s p e c :   c o n t a i n e r s :   -   n a m e :   s h e l l   c o m m a n d :   [ " s l e e p " ,   " i n f i n i t y " ]   i m a g e :   d e b i a n   v o l u m e M o u n t s :   -   n a m e :   v o l u m e   m o u n t P a t h :   / v o l u m e   v o l u m e s :   -   n a m e :   v o l u m e   i m a g e :   r e f e r e n c e :   q u a y . i o / c r i o / a r t i f a c t : v 2   p u l l P o l i c y :   I f N o t P r e s e n t   T h e   v o l u m e   i s   r e s o l v e d   a t   p o d   s t a r t u p   d e p e n d i n g   o n   w h i c h   p u l l P o l i c y   v a l u e   i s   p r o v i d e d :   T h e   v o l u m e   g e t s   r e - r e s o l v e d   i f   t h e   p o d   g e t s   d e l e t e d   a n d   r e c r e a t e d ,   w h i c h   m e a n s   t h a t   n e w   r e m o t e   c o n t e n t   w i l l   b e c o m e   a v a i l a b l e   o n   p o d   r e c r e a t i o n .   A   f a i l u r e   t o   r e s o l v e   o r   p u l l   t h e   i m a g e   d u r i n g   p o d   s t a r t u p   w i l l   b l o c k   c o n t a i n e r s   f r o m   s t a r t i n g   a n d   m a y   a d d   s i g n i f i c a n t   l a t e n c y .   F a i l u r e s   w i l l   b e   r e t r i e d   u s i n g   n o r m a l   v o l u m e   b a c k o f f   a n d   w i l l   b e   r e p o r t e d   o n   t h e   p o d   r e a s o n   a n d   m e s s a g e .   T h e   t y p e s   o f   o b j e c t s   t h a t   m a y   b e   m o u n t e d   b y   t h i s   v o l u m e   a r e   d e f i n e d   b y   t h e   c o n t a i n e r   r u n


Question: What is iscsi?

Answer: A n   i s c s i   v o l u m e   a l l o w s   a n   e x i s t i n g   i S C S I   ( S C S I   o v e r   I P )   v o l u m e   t o   b e   m o u n t e d   i n t o   y o u r   P o d .   U n l i k e   e m p t y D i r ,   w h i c h   i s   e r a s e d   w h e n   a   P o d   i s   r e m o v e d ,   t h e   c o n t e n t s   o f   a n   i s c s i   v o l u m e   a r e   p r e s e r v e d   a n d   t h e   v o l u m e   i s   m e r e l y   u n m o u n t e d .   T h i s   m e a n s   t h a t   a n   i s c s i   v o l u m e   c a n   b e   p r e - p o p u l a t e d   w i t h   d a t a ,   a n d   t h a t   d a t a   c a n   b e   s h a r e d   b e t w e e n   p o d s .


Question: What is Note:?

Answer: A   f e a t u r e   o f   i S C S I   i s   t h a t   i t   c a n   b e   m o u n t e d   a s   r e a d - o n l y   b y   m u l t i p l e   c o n s u m e r s   s i m u l t a n e o u s l y .   T h i s   m e a n s   t h a t   y o u   c a n   p r e - p o p u l a t e   a   v o l u m e   w i t h   y o u r   d a t a s e t   a n d   t h e n   s e r v e   i t   i n   p a r a l l e l   f r o m   a s   m a n y   P o d s   a s   y o u   n e e d .   U n f o r t u n a t e l y ,   i S C S I   v o l u m e s   c a n   o n l y   b e   m o u n t e d   b y   a   s i n g l e   c o n s u m e r   i n   r e a d - w r i t e   m o d e .   S i m u l t a n e o u s   w r i t e r s   a r e   n o t   a l l o w e d .


Question: What is local?

Answer: A   l o c a l   v o l u m e   r e p r e s e n t s   a   m o u n t e d   l o c a l   s t o r a g e   d e v i c e   s u c h   a s   a   d i s k ,   p a r t i t i o n   o r   d i r e c t o r y .   L o c a l   v o l u m e s   c a n   o n l y   b e   u s e d   a s   a   s t a t i c a l l y   c r e a t e d   P e r s i s t e n t V o l u m e .   D y n a m i c   p r o v i s i o n i n g   i s   n o t   s u p p o r t e d .   C o m p a r e d   t o   h o s t P a t h   v o l u m e s ,   l o c a l   v o l u m e s   a r e   u s e d   i n   a   d u r a b l e   a n d   p o r t a b l e   m a n n e r   w i t h o u t   m a n u a l l y   s c h e d u l i n g   p o d s   t o   n o d e s .   T h e   s y s t e m   i s   a w a r e   o f   t h e   v o l u m e ' s   n o d e   c o n s t r a i n t s   b y   l o o k i n g   a t   t h e   n o d e   a f f i n i t y   o n   t h e   P e r s i s t e n t V o l u m e .   H o w e v e r ,   l o c a l   v o l u m e s   a r e   s u b j e c t   t o   t h e   a v a i l a b i l i t y   o f   t h e   u n d e r l y i n g   n o d e   a n d   a r e   n o t   s u i t a b l e   f o r   a l l   a p p l i c a t i o n s .   I f   a   n o d e   b e c o m e s   u n h e a l t h y ,   t h e n   t h e   l o c a l   v o l u m e   b e c o m e s   i n a c c e s s i b l e   t o   t h e   p o d .   T h e   p o d   u s i n g   t h i s   v o l u m e   i s   u n a b l e   t o   r u n .   A p p l i c a t i o n s   u s i n g   l o c a l   v o l u m e s   m u s t   b e   a b l e   t o   t o l e r a t e   t h i s   r e d u c e d   a v a i l a b i l i t y ,   a s   w e l l   a s   p o t e n t i a l   d a t a   l o s s ,   d e p e n d i n g   o n   t h e   d u r a b i l i t y   c h a r a c t e r i s t i c s   o f   t h e   u n d e r l y i n g   d i s k .   T h e   f o l l o w i n g   e x a m p l e   s h o w s   a   P e r s i s t e n t V o l u m e   u s i n g   a   l o c a l   v o l u m e   a n d   n o d e A f f i n i t y :   a p i V e r s i o n :   v 1   k i n d :   P e r s i s t e n t V


Question: What is nfs?

Answer: A n   n f s   v o l u m e   a l l o w s   a n   e x i s t i n g   N F S   ( N e t w o r k   F i l e   S y s t e m )   s h a r e   t o   b e   m o u n t e d   i n t o   a   P o d .   U n l i k e   e m p t y D i r ,   w h i c h   i s   e r a s e d   w h e n   a   P o d   i s   r e m o v e d ,   t h e   c o n t e n t s   o f   a n   n f s   v o l u m e   a r e   p r e s e r v e d   a n d   t h e   v o l u m e   i s   m e r e l y   u n m o u n t e d .   T h i s   m e a n s   t h a t   a n   N F S   v o l u m e   c a n   b e   p r e - p o p u l a t e d   w i t h   d a t a ,   a n d   t h a t   d a t a   c a n   b e   s h a r e d   b e t w e e n   p o d s .   N F S   c a n   b e   m o u n t e d   b y   m u l t i p l e   w r i t e r s   s i m u l t a n e o u s l y .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - p d   s p e c :   c o n t a i n e r s :   -   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r   n a m e :   t e s t - c o n t a i n e r   v o l u m e M o u n t s :   -   m o u n t P a t h :   / m y - n f s - d a t a   n a m e :   t e s t - v o l u m e   v o l u m e s :   -   n a m e :   t e s t - v o l u m e   n f s :   s e r v e r :   m y - n f s - s e r v e r . e x a m p l e . c o m   p a t h :   / m y - n f s - v o l u m e   r e a d O n l y :   t r u e


Question: What is Note:?

Answer: Y o u   m u s t   h a v e   y o u r   o w n   N F S   s e r v e r   r u n n i n g   w i t h   t h e   s h a r e   e x p o r t e d   b e f o r e   y o u   c a n   u s e   i t .   A l s o   n o t e   t h a t   y o u   c a n ' t   s p e c i f y   N F S   m o u n t   o p t i o n s   i n   a   P o d   s p e c .   Y o u   c a n   e i t h e r   s e t   m o u n t   o p t i o n s   s e r v e r - s i d e   o r   u s e   / e t c / n f s m o u n t . c o n f .   Y o u   c a n   a l s o   m o u n t   N F S   v o l u m e s   v i a   P e r s i s t e n t V o l u m e s   w h i c h   d o   a l l o w   y o u   t o   s e t   m o u n t   o p t i o n s .


Question: What is persistentVolumeClaim?

Answer: A   p e r s i s t e n t V o l u m e C l a i m   v o l u m e   i s   u s e d   t o   m o u n t   a   P e r s i s t e n t V o l u m e   i n t o   a   P o d .   P e r s i s t e n t V o l u m e C l a i m s   a r e   a   w a y   f o r   u s e r s   t o   " c l a i m "   d u r a b l e   s t o r a g e   ( s u c h   a s   a n   i S C S I   v o l u m e )   w i t h o u t   k n o w i n g   t h e   d e t a i l s   o f   t h e   p a r t i c u l a r   c l o u d   e n v i r o n m e n t .   S e e   t h e   i n f o r m a t i o n   a b o u t   P e r s i s t e n t V o l u m e s   f o r   m o r e   d e t a i l s .


Question: What is portworxVolume (deprecated)?

Answer: A   p o r t w o r x V o l u m e   i s   a n   e l a s t i c   b l o c k   s t o r a g e   l a y e r   t h a t   r u n s   h y p e r c o n v e r g e d   w i t h   K u b e r n e t e s .   P o r t w o r x   f i n g e r p r i n t s   s t o r a g e   i n   a   s e r v e r ,   t i e r s   b a s e d   o n   c a p a b i l i t i e s ,   a n d   a g g r e g a t e s   c a p a c i t y   a c r o s s   m u l t i p l e   s e r v e r s .   P o r t w o r x   r u n s   i n - g u e s t   i n   v i r t u a l   m a c h i n e s   o r   o n   b a r e   m e t a l   L i n u x   n o d e s .   A   p o r t w o r x V o l u m e   c a n   b e   d y n a m i c a l l y   c r e a t e d   t h r o u g h   K u b e r n e t e s   o r   i t   c a n   a l s o   b e   p r e - p r o v i s i o n e d   a n d   r e f e r e n c e d   i n s i d e   a   P o d .   H e r e   i s   a n   e x a m p l e   P o d   r e f e r e n c i n g   a   p r e - p r o v i s i o n e d   P o r t w o r x   v o l u m e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   t e s t - p o r t w o r x - v o l u m e - p o d   s p e c :   c o n t a i n e r s :   -   i m a g e :   r e g i s t r y . k 8 s . i o / t e s t - w e b s e r v e r   n a m e :   t e s t - c o n t a i n e r   v o l u m e M o u n t s :   -   m o u n t P a t h :   / m n t   n a m e :   p x v o l   v o l u m e s :   -   n a m e :   p x v o l   #   T h i s   P o r t w o r x   v o l u m e   m u s t   a l r e a d y   e x i s t .   p o r t w o r x V o l u m e :   v o l u m e I D :   " p x v o l "   f s T y p e :   " < f s - t y p e > "


Question: What is Portworx CSI migration?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   P o r t w o r x   v o l u m e s   a r e   r e d i r e c t e d   t o   t h e   p x d . p o r t w o r x . c o m   C o n t a i n e r   S t o r a g e   I n t e r f a c e   ( C S I )   D r i v e r   b y   d e f a u l t . P o r t w o r x   C S I   D r i v e r   m u s t   b e   i n s t a l l e d   o n   t h e   c l u s t e r .


Question: What is projected?

Answer: A   p r o j e c t e d   v o l u m e   m a p s   s e v e r a l   e x i s t i n g   v o l u m e   s o u r c e s   i n t o   t h e   s a m e   d i r e c t o r y .   F o r   m o r e   d e t a i l s ,   s e e   p r o j e c t e d   v o l u m e s .


Question: What is rbd (removed)?

Answer: K u b e r n e t e s   1 . 3 4   d o e s   n o t   i n c l u d e   a   r b d   v o l u m e   t y p e .   T h e   R a d o s   B l o c k   D e v i c e   ( R B D )   i n - t r e e   s t o r a g e   d r i v e r   a n d   i t s   c s i   m i g r a t i o n   s u p p o r t   w e r e   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 2 8   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 3 1   r e l e a s e .


Question: What is secret?

Answer: A   s e c r e t   v o l u m e   i s   u s e d   t o   p a s s   s e n s i t i v e   i n f o r m a t i o n ,   s u c h   a s   p a s s w o r d s ,   t o   P o d s .   Y o u   c a n   s t o r e   s e c r e t s   i n   t h e   K u b e r n e t e s   A P I   a n d   m o u n t   t h e m   a s   f i l e s   f o r   u s e   b y   p o d s   w i t h o u t   c o u p l i n g   t o   K u b e r n e t e s   d i r e c t l y .   s e c r e t   v o l u m e s   a r e   b a c k e d   b y   t m p f s   ( a   R A M - b a c k e d   f i l e s y s t e m )   s o   t h e y   a r e   n e v e r   w r i t t e n   t o   n o n - v o l a t i l e   s t o r a g e .


Question: What is Note:?

Answer: Y o u   m u s t   c r e a t e   a   S e c r e t   i n   t h e   K u b e r n e t e s   A P I   b e f o r e   y o u   c a n   u s e   i t . A   S e c r e t   i s   a l w a y s   m o u n t e d   a s   r e a d O n l y . A   c o n t a i n e r   u s i n g   a   S e c r e t   a s   a   s u b P a t h   v o l u m e   m o u n t   w i l l   n o t   r e c e i v e   S e c r e t   u p d a t e s .   Y o u   m u s t   c r e a t e   a   S e c r e t   i n   t h e   K u b e r n e t e s   A P I   b e f o r e   y o u   c a n   u s e   i t .   A   S e c r e t   i s   a l w a y s   m o u n t e d   a s   r e a d O n l y .   A   c o n t a i n e r   u s i n g   a   S e c r e t   a s   a   s u b P a t h   v o l u m e   m o u n t   w i l l   n o t   r e c e i v e   S e c r e t   u p d a t e s .   F o r   m o r e   d e t a i l s ,   s e e   C o n f i g u r i n g   S e c r e t s .


Question: What is vsphereVolume (deprecated)?

Answer: I n   K u b e r n e t e s   1 . 3 4 ,   a l l   o p e r a t i o n s   f o r   t h e   i n - t r e e   v s p h e r e V o l u m e   t y p e   a r e   r e d i r e c t e d   t o   t h e   c s i . v s p h e r e . v m w a r e . c o m   C S I   d r i v e r .   T h e   v s p h e r e V o l u m e   i n - t r e e   s t o r a g e   d r i v e r   w a s   d e p r e c a t e d   i n   t h e   K u b e r n e t e s   v 1 . 1 9   r e l e a s e   a n d   t h e n   r e m o v e d   e n t i r e l y   i n   t h e   v 1 . 3 0   r e l e a s e .   T h e   K u b e r n e t e s   p r o j e c t   s u g g e s t s   t h a t   y o u   u s e   t h e   v S p h e r e   C S I   t h i r d   p a r t y   s t o r a g e   d r i v e r   i n s t e a d .


Question: What is Using subPath?

Answer: S o m e t i m e s ,   i t   i s   u s e f u l   t o   s h a r e   o n e   v o l u m e   f o r   m u l t i p l e   u s e s   i n   a   s i n g l e   p o d .   T h e   v o l u m e M o u n t s [ * ] . s u b P a t h   p r o p e r t y   s p e c i f i e s   a   s u b - p a t h   i n s i d e   t h e   r e f e r e n c e d   v o l u m e   i n s t e a d   o f   i t s   r o o t .   T h e   f o l l o w i n g   e x a m p l e   s h o w s   h o w   t o   c o n f i g u r e   a   P o d   w i t h   a   L A M P   s t a c k   ( L i n u x   A p a c h e   M y S Q L   P H P )   u s i n g   a   s i n g l e ,   s h a r e d   v o l u m e .   T h i s   s a m p l e   s u b P a t h   c o n f i g u r a t i o n   i s   n o t   r e c o m m e n d e d   f o r   p r o d u c t i o n   u s e .   T h e   P H P   a p p l i c a t i o n ' s   c o d e   a n d   a s s e t s   m a p   t o   t h e   v o l u m e ' s   h t m l   f o l d e r   a n d   t h e   M y S Q L   d a t a b a s e   i s   s t o r e d   i n   t h e   v o l u m e ' s   m y s q l   f o l d e r .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   m y - l a m p - s i t e   s p e c :   c o n t a i n e r s :   -   n a m e :   m y s q l   i m a g e :   m y s q l   e n v :   -   n a m e :   M Y S Q L _ R O O T _ P A S S W O R D   v a l u e :   " r o o t p a s s w d "   v o l u m e M o u n t s :   -   m o u n t P a t h :   / v a r / l i b / m y s q l   n a m e :   s i t e - d a t a   s u b P a t h :   m y s q l   -   n a m e :   p h p   i m a g e :   p h p : 7 . 0 - a p a c h e   v o l u m e M o u n t s :   -   m o u n t P a t h :   / v a r / w w w / h t m l   n a m e :   s i t e - d a t a   s u b P a t h :   h t m l   v o l u m e s :   -   n a m e :   s i t e - d a t a   p e r s i s t e n t V o l u m e C l a i m :   c l a i m N a m e :   m y - l a m p - s i t e - d a t a


Question: What is Using subPath with expanded environment variables?

Answer: U s e   t h e   s u b P a t h E x p r   f i e l d   t o   c o n s t r u c t   s u b P a t h   d i r e c t o r y   n a m e s   f r o m   d o w n w a r d   A P I   e n v i r o n m e n t   v a r i a b l e s .   T h e   s u b P a t h   a n d   s u b P a t h E x p r   p r o p e r t i e s   a r e   m u t u a l l y   e x c l u s i v e .   I n   t h i s   e x a m p l e ,   a   P o d   u s e s   s u b P a t h E x p r   t o   c r e a t e   a   d i r e c t o r y   p o d 1   w i t h i n   t h e   h o s t P a t h   v o l u m e   / v a r / l o g / p o d s .   T h e   h o s t P a t h   v o l u m e   t a k e s   t h e   P o d   n a m e   f r o m   t h e   d o w n w a r d A P I .   T h e   h o s t   d i r e c t o r y   / v a r / l o g / p o d s / p o d 1   i s   m o u n t e d   a t   / l o g s   i n   t h e   c o n t a i n e r .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   p o d 1   s p e c :   c o n t a i n e r s :   -   n a m e :   c o n t a i n e r 1   e n v :   -   n a m e :   P O D _ N A M E   v a l u e F r o m :   f i e l d R e f :   a p i V e r s i o n :   v 1   f i e l d P a t h :   m e t a d a t a . n a m e   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [   " s h " ,   " - c " ,   " w h i l e   [   t r u e   ] ;   d o   e c h o   ' H e l l o ' ;   s l e e p   1 0 ;   d o n e   |   t e e   - a   / l o g s / h e l l o . t x t "   ]   v o l u m e M o u n t s :   -   n a m e :   w o r k d i r 1   m o u n t P a t h :   / l o g s   #   T h e   v a r i a b l e   e x p a n s i o n   u s e s   r o u n d   b r a c k e t s   ( n o t   c u r l y   b r a c k e t s ) .   s u b P a t h E x p r :   $ ( P O D _ N A M E )   r e s t a r t P o l i c y :   N e v e r   v o l u m e s :   -   n a m e :   w o r k d i r 1   h o s t P a t h :   p a t h :   / v a r / l o g / p o d s


Question: What is Resources?

Answer: T h e   s t o r a g e   m e d i u m   ( s u c h   a s   D i s k   o r   S S D )   o f   a n   e m p t y D i r   v o l u m e   i s   d e t e r m i n e d   b y   t h e   m e d i u m   o f   t h e   f i l e s y s t e m   h o l d i n g   t h e   k u b e l e t   r o o t   d i r   ( t y p i c a l l y   / v a r / l i b / k u b e l e t ) .   T h e r e   i s   n o   l i m i t   o n   h o w   m u c h   s p a c e   a n   e m p t y D i r   o r   h o s t P a t h   v o l u m e   c a n   c o n s u m e ,   a n d   n o   i s o l a t i o n   b e t w e e n   c o n t a i n e r s   o r   p o d s .   T o   l e a r n   a b o u t   r e q u e s t i n g   s p a c e   u s i n g   a   r e s o u r c e   s p e c i f i c a t i o n ,   s e e   h o w   t o   m a n a g e   r e s o u r c e s .


Question: What is Out-of-tree volume plugins?

Answer: T h e   o u t - o f - t r e e   v o l u m e   p l u g i n s   i n c l u d e   C o n t a i n e r   S t o r a g e   I n t e r f a c e   ( C S I ) ,   a n d   a l s o   F l e x V o l u m e   ( w h i c h   i s   d e p r e c a t e d ) .   T h e s e   p l u g i n s   e n a b l e   s t o r a g e   v e n d o r s   t o   c r e a t e   c u s t o m   s t o r a g e   p l u g i n s   w i t h o u t   a d d i n g   t h e i r   p l u g i n   s o u r c e   c o d e   t o   t h e   K u b e r n e t e s   r e p o s i t o r y .   P r e v i o u s l y ,   a l l   v o l u m e   p l u g i n s   w e r e   " i n - t r e e " .   T h e   " i n - t r e e "   p l u g i n s   w e r e   b u i l t ,   l i n k e d ,   c o m p i l e d ,   a n d   s h i p p e d   w i t h   t h e   c o r e   K u b e r n e t e s   b i n a r i e s .   T h i s   m e a n t   t h a t   a d d i n g   a   n e w   s t o r a g e   s y s t e m   t o   K u b e r n e t e s   ( a   v o l u m e   p l u g i n )   r e q u i r e d   c h e c k i n g   c o d e   i n t o   t h e   c o r e   K u b e r n e t e s   c o d e   r e p o s i t o r y .   B o t h   C S I   a n d   F l e x V o l u m e   a l l o w   v o l u m e   p l u g i n s   t o   b e   d e v e l o p e d   i n d e p e n d e n t l y   o f   t h e   K u b e r n e t e s   c o d e   b a s e ,   a n d   d e p l o y e d   ( i n s t a l l e d )   o n   K u b e r n e t e s   c l u s t e r s   a s   e x t e n s i o n s .   F o r   s t o r a g e   v e n d o r s   l o o k i n g   t o   c r e a t e   a n   o u t - o f - t r e e   v o l u m e   p l u g i n ,   p l e a s e   r e f e r   t o   t h e   v o l u m e   p l u g i n   F A Q .