Question: What is User exposed information?

Answer: W h e n   P o d   P   p r e e m p t s   o n e   o r   m o r e   P o d s   o n   N o d e   N ,   n o m i n a t e d N o d e N a m e   f i e l d   o f   P o d   P ' s   s t a t u s   i s   s e t   t o   t h e   n a m e   o f   N o d e   N .   T h i s   f i e l d   h e l p s   t h e   s c h e d u l e r   t r a c k   r e s o u r c e s   r e s e r v e d   f o r   P o d   P   a n d   a l s o   g i v e s   u s e r s   i n f o r m a t i o n   a b o u t   p r e e m p t i o n s   i n   t h e i r   c l u s t e r s .   P l e a s e   n o t e   t h a t   P o d   P   i s   n o t   n e c e s s a r i l y   s c h e d u l e d   t o   t h e   " n o m i n a t e d   N o d e " .   T h e   s c h e d u l e r   a l w a y s   t r i e s   t h e   " n o m i n a t e d   N o d e "   b e f o r e   i t e r a t i n g   o v e r   a n y   o t h e r   n o d e s .   A f t e r   v i c t i m   P o d s   a r e   p r e e m p t e d ,   t h e y   g e t   t h e i r   g r a c e f u l   t e r m i n a t i o n   p e r i o d .   I f   a n o t h e r   n o d e   b e c o m e s   a v a i l a b l e   w h i l e   s c h e d u l e r   i s   w a i t i n g   f o r   t h e   v i c t i m   P o d s   t o   t e r m i n a t e ,   s c h e d u l e r   m a y   u s e   t h e   o t h e r   n o d e   t o   s c h e d u l e   P o d   P .   A s   a   r e s u l t   n o m i n a t e d N o d e N a m e   a n d   n o d e N a m e   o f   P o d   s p e c   a r e   n o t   a l w a y s   t h e   s a m e .   A l s o ,   i f   t h e   s c h e d u l e r   p r e e m p t s   P o d s   o n   N o d e   N ,   b u t   t h e n   a   h i g h e r   p r i o r i t y   P o d   t h a n   P o d   P   a r r i v e s ,   t h e   s c h e d u l e r   m a y   g i v e   N o d e   N   t o   t h e   n e w   h i g h e r   p r i o r i t y   P o d .   I n   s u c h   a   c a s e ,   s c h e d u l e r   c l e a r s   n o m i n a t e d N o d e N a m e   o f   P o d   P .   B y   d o i n g   t h i s ,   s c h e d u l e r   m a k e s   P o d   P   e l i g i b l e   t o   p r e e m


Question: What is Graceful termination of preemption victims?

Answer: W h e n   P o d s   a r e   p r e e m p t e d ,   t h e   v i c t i m s   g e t   t h e i r   g r a c e f u l   t e r m i n a t i o n   p e r i o d .   T h e y   h a v e   t h a t   m u c h   t i m e   t o   f i n i s h   t h e i r   w o r k   a n d   e x i t .   I f   t h e y   d o n ' t ,   t h e y   a r e   k i l l e d .   T h i s   g r a c e f u l   t e r m i n a t i o n   p e r i o d   c r e a t e s   a   t i m e   g a p   b e t w e e n   t h e   p o i n t   t h a t   t h e   s c h e d u l e r   p r e e m p t s   P o d s   a n d   t h e   t i m e   w h e n   t h e   p e n d i n g   P o d   ( P )   c a n   b e   s c h e d u l e d   o n   t h e   N o d e   ( N ) .   I n   t h e   m e a n t i m e ,   t h e   s c h e d u l e r   k e e p s   s c h e d u l i n g   o t h e r   p e n d i n g   P o d s .   A s   v i c t i m s   e x i t   o r   g e t   t e r m i n a t e d ,   t h e   s c h e d u l e r   t r i e s   t o   s c h e d u l e   P o d s   i n   t h e   p e n d i n g   q u e u e .   T h e r e f o r e ,   t h e r e   i s   u s u a l l y   a   t i m e   g a p   b e t w e e n   t h e   p o i n t   t h a t   s c h e d u l e r   p r e e m p t s   v i c t i m s   a n d   t h e   t i m e   t h a t   P o d   P   i s   s c h e d u l e d .   I n   o r d e r   t o   m i n i m i z e   t h i s   g a p ,   o n e   c a n   s e t   g r a c e f u l   t e r m i n a t i o n   p e r i o d   o f   l o w e r   p r i o r i t y   P o d s   t o   z e r o   o r   a   s m a l l   n u m b e r .


Question: What is PodDisruptionBudget is supported, but not guaranteed?

Answer: A   P o d D i s r u p t i o n B u d g e t   ( P D B )   a l l o w s   a p p l i c a t i o n   o w n e r s   t o   l i m i t   t h e   n u m b e r   o f   P o d s   o f   a   r e p l i c a t e d   a p p l i c a t i o n   t h a t   a r e   d o w n   s i m u l t a n e o u s l y   f r o m   v o l u n t a r y   d i s r u p t i o n s .   K u b e r n e t e s   s u p p o r t s   P D B   w h e n   p r e e m p t i n g   P o d s ,   b u t   r e s p e c t i n g   P D B   i s   b e s t   e f f o r t .   T h e   s c h e d u l e r   t r i e s   t o   f i n d   v i c t i m s   w h o s e   P D B   a r e   n o t   v i o l a t e d   b y   p r e e m p t i o n ,   b u t   i f   n o   s u c h   v i c t i m s   a r e   f o u n d ,   p r e e m p t i o n   w i l l   s t i l l   h a p p e n ,   a n d   l o w e r   p r i o r i t y   P o d s   w i l l   b e   r e m o v e d   d e s p i t e   t h e i r   P D B s   b e i n g   v i o l a t e d .


Question: What is Inter-Pod affinity on lower-priority Pods?

Answer: A   N o d e   i s   c o n s i d e r e d   f o r   p r e e m p t i o n   o n l y   w h e n   t h e   a n s w e r   t o   t h i s   q u e s t i o n   i s   y e s :   " I f   a l l   t h e   P o d s   w i t h   l o w e r   p r i o r i t y   t h a n   t h e   p e n d i n g   P o d   a r e   r e m o v e d   f r o m   t h e   N o d e ,   c a n   t h e   p e n d i n g   P o d   b e   s c h e d u l e d   o n   t h e   N o d e ? "


Question: What is Note:?

Answer: I f   a   p e n d i n g   P o d   h a s   i n t e r - p o d   a f f i n i t y   t o   o n e   o r   m o r e   o f   t h e   l o w e r - p r i o r i t y   P o d s   o n   t h e   N o d e ,   t h e   i n t e r - P o d   a f f i n i t y   r u l e   c a n n o t   b e   s a t i s f i e d   i n   t h e   a b s e n c e   o f   t h o s e   l o w e r - p r i o r i t y   P o d s .   I n   t h i s   c a s e ,   t h e   s c h e d u l e r   d o e s   n o t   p r e e m p t   a n y   P o d s   o n   t h e   N o d e .   I n s t e a d ,   i t   l o o k s   f o r   a n o t h e r   N o d e .   T h e   s c h e d u l e r   m i g h t   f i n d   a   s u i t a b l e   N o d e   o r   i t   m i g h t   n o t .   T h e r e   i s   n o   g u a r a n t e e   t h a t   t h e   p e n d i n g   P o d   c a n   b e   s c h e d u l e d .   O u r   r e c o m m e n d e d   s o l u t i o n   f o r   t h i s   p r o b l e m   i s   t o   c r e a t e   i n t e r - P o d   a f f i n i t y   o n l y   t o w a r d s   e q u a l   o r   h i g h e r   p r i o r i t y   P o d s .


Question: What is Cross node preemption?

Answer: S u p p o s e   a   N o d e   N   i s   b e i n g   c o n s i d e r e d   f o r   p r e e m p t i o n   s o   t h a t   a   p e n d i n g   P o d   P   c a n   b e   s c h e d u l e d   o n   N .   P   m i g h t   b e c o m e   f e a s i b l e   o n   N   o n l y   i f   a   P o d   o n   a n o t h e r   N o d e   i s   p r e e m p t e d .   H e r e ' s   a n   e x a m p l e :   P o d   P   i s   b e i n g   c o n s i d e r e d   f o r   N o d e   N . P o d   Q   i s   r u n n i n g   o n   a n o t h e r   N o d e   i n   t h e   s a m e   Z o n e   a s   N o d e   N . P o d   P   h a s   Z o n e - w i d e   a n t i - a f f i n i t y   w i t h   P o d   Q   ( t o p o l o g y K e y :   t o p o l o g y . k u b e r n e t e s . i o / z o n e ) . T h e r e   a r e   n o   o t h e r   c a s e s   o f   a n t i - a f f i n i t y   b e t w e e n   P o d   P   a n d   o t h e r   P o d s   i n   t h e   Z o n e . I n   o r d e r   t o   s c h e d u l e   P o d   P   o n   N o d e   N ,   P o d   Q   c a n   b e   p r e e m p t e d ,   b u t   s c h e d u l e r   d o e s   n o t   p e r f o r m   c r o s s - n o d e   p r e e m p t i o n .   S o ,   P o d   P   w i l l   b e   d e e m e d   u n s c h e d u l a b l e   o n   N o d e   N .   I f   P o d   Q   w e r e   r e m o v e d   f r o m   i t s   N o d e ,   t h e   P o d   a n t i - a f f i n i t y   v i o l a t i o n   w o u l d   b e   g o n e ,   a n d   P o d   P   c o u l d   p o s s i b l y   b e   s c h e d u l e d   o n   N o d e   N .   W e   m a y   c o n s i d e r   a d d i n g   c r o s s   N o d e   p r e e m p t i o n   i n   f u t u r e   v e r s i o n s   i f   t h e r e   i s   e n o u g h   d e m a n d   a n d   i f   w e   f i n d   a n   a l g o r i t h m   w i t h   r e a s o n a b l e   p e r f o r m a n c e .


Question: What is Troubleshooting?

Answer: P o d   p r i o r i t y   a n d   p r e e m p t i o n   c a n   h a v e   u n w a n t e d   s i d e   e f f e c t s .   H e r e   a r e   s o m e   e x a m p l e s   o f   p o t e n t i a l   p r o b l e m s   a n d   w a y s   t o   d e a l   w i t h   t h e m .


Question: What is Pods are preempted unnecessarily?

Answer: P r e e m p t i o n   r e m o v e s   e x i s t i n g   P o d s   f r o m   a   c l u s t e r   u n d e r   r e s o u r c e   p r e s s u r e   t o   m a k e   r o o m   f o r   h i g h e r   p r i o r i t y   p e n d i n g   P o d s .   I f   y o u   g i v e   h i g h   p r i o r i t i e s   t o   c e r t a i n   P o d s   b y   m i s t a k e ,   t h e s e   u n i n t e n t i o n a l l y   h i g h   p r i o r i t y   P o d s   m a y   c a u s e   p r e e m p t i o n   i n   y o u r   c l u s t e r .   P o d   p r i o r i t y   i s   s p e c i f i e d   b y   s e t t i n g   t h e   p r i o r i t y C l a s s N a m e   f i e l d   i n   t h e   P o d ' s   s p e c i f i c a t i o n .   T h e   i n t e g e r   v a l u e   f o r   p r i o r i t y   i s   t h e n   r e s o l v e d   a n d   p o p u l a t e d   t o   t h e   p r i o r i t y   f i e l d   o f   p o d S p e c .   T o   a d d r e s s   t h e   p r o b l e m ,   y o u   c a n   c h a n g e   t h e   p r i o r i t y C l a s s N a m e   f o r   t h o s e   P o d s   t o   u s e   l o w e r   p r i o r i t y   c l a s s e s ,   o r   l e a v e   t h a t   f i e l d   e m p t y .   A n   e m p t y   p r i o r i t y C l a s s N a m e   i s   r e s o l v e d   t o   z e r o   b y   d e f a u l t .   W h e n   a   P o d   i s   p r e e m p t e d ,   t h e r e   w i l l   b e   e v e n t s   r e c o r d e d   f o r   t h e   p r e e m p t e d   P o d .   P r e e m p t i o n   s h o u l d   h a p p e n   o n l y   w h e n   a   c l u s t e r   d o e s   n o t   h a v e   e n o u g h   r e s o u r c e s   f o r   a   P o d .   I n   s u c h   c a s e s ,   p r e e m p t i o n   h a p p e n s   o n l y   w h e n   t h e   p r i o r i t y   o f   t h e   p e n d i n g   P o d   ( p r e e m p t o r )   i s   h i g h e r   t h a n   t h e   v i c t i m   P o d s .   P r e e m p t i o n   m u s t   n o t   h a p p e n   w h e n   t h e r e   i s   n o   p e n d i n g   P o d ,   o r   w h e n   t h e   p e n d i n g   P o


Question: What is Pods are preempted, but the preemptor is not scheduled?

Answer: W h e n   p o d s   a r e   p r e e m p t e d ,   t h e y   r e c e i v e   t h e i r   r e q u e s t e d   g r a c e f u l   t e r m i n a t i o n   p e r i o d ,   w h i c h   i s   b y   d e f a u l t   3 0   s e c o n d s .   I f   t h e   v i c t i m   P o d s   d o   n o t   t e r m i n a t e   w i t h i n   t h i s   p e r i o d ,   t h e y   a r e   f o r c i b l y   t e r m i n a t e d .   O n c e   a l l   t h e   v i c t i m s   g o   a w a y ,   t h e   p r e e m p t o r   P o d   c a n   b e   s c h e d u l e d .   W h i l e   t h e   p r e e m p t o r   P o d   i s   w a i t i n g   f o r   t h e   v i c t i m s   t o   g o   a w a y ,   a   h i g h e r   p r i o r i t y   P o d   m a y   b e   c r e a t e d   t h a t   f i t s   o n   t h e   s a m e   N o d e .   I n   t h i s   c a s e ,   t h e   s c h e d u l e r   w i l l   s c h e d u l e   t h e   h i g h e r   p r i o r i t y   P o d   i n s t e a d   o f   t h e   p r e e m p t o r .   T h i s   i s   e x p e c t e d   b e h a v i o r :   t h e   P o d   w i t h   t h e   h i g h e r   p r i o r i t y   s h o u l d   t a k e   t h e   p l a c e   o f   a   P o d   w i t h   a   l o w e r   p r i o r i t y .


Question: What is Higher priority Pods are preempted before lower priority pods?

Answer: T h e   s c h e d u l e r   t r i e s   t o   f i n d   n o d e s   t h a t   c a n   r u n   a   p e n d i n g   P o d .   I f   n o   n o d e   i s   f o u n d ,   t h e   s c h e d u l e r   t r i e s   t o   r e m o v e   P o d s   w i t h   l o w e r   p r i o r i t y   f r o m   a n   a r b i t r a r y   n o d e   i n   o r d e r   t o   m a k e   r o o m   f o r   t h e   p e n d i n g   p o d .   I f   a   n o d e   w i t h   l o w   p r i o r i t y   P o d s   i s   n o t   f e a s i b l e   t o   r u n   t h e   p e n d i n g   P o d ,   t h e   s c h e d u l e r   m a y   c h o o s e   a n o t h e r   n o d e   w i t h   h i g h e r   p r i o r i t y   P o d s   ( c o m p a r e d   t o   t h e   P o d s   o n   t h e   o t h e r   n o d e )   f o r   p r e e m p t i o n .   T h e   v i c t i m s   m u s t   s t i l l   h a v e   l o w e r   p r i o r i t y   t h a n   t h e   p r e e m p t o r   P o d .   W h e n   t h e r e   a r e   m u l t i p l e   n o d e s   a v a i l a b l e   f o r   p r e e m p t i o n ,   t h e   s c h e d u l e r   t r i e s   t o   c h o o s e   t h e   n o d e   w i t h   a   s e t   o f   P o d s   w i t h   l o w e s t   p r i o r i t y .   H o w e v e r ,   i f   s u c h   P o d s   h a v e   P o d D i s r u p t i o n B u d g e t   t h a t   w o u l d   b e   v i o l a t e d   i f   t h e y   a r e   p r e e m p t e d   t h e n   t h e   s c h e d u l e r   m a y   c h o o s e   a n o t h e r   n o d e   w i t h   h i g h e r   p r i o r i t y   P o d s .   W h e n   m u l t i p l e   n o d e s   e x i s t   f o r   p r e e m p t i o n   a n d   n o n e   o f   t h e   a b o v e   s c e n a r i o s   a p p l y ,   t h e   s c h e d u l e r   c h o o s e s   a   n o d e   w i t h   t h e   l o w e s t   p r i o r i t y .


Question: What is Interactions between Pod priority and quality of service?

Answer: P o d   p r i o r i t y   a n d   Q o S   c l a s s   a r e   t w o   o r t h o g o n a l   f e a t u r e s   w i t h   f e w   i n t e r a c t i o n s   a n d   n o   d e f a u l t   r e s t r i c t i o n s   o n   s e t t i n g   t h e   p r i o r i t y   o f   a   P o d   b a s e d   o n   i t s   Q o S   c l a s s e s .   T h e   s c h e d u l e r ' s   p r e e m p t i o n   l o g i c   d o e s   n o t   c o n s i d e r   Q o S   w h e n   c h o o s i n g   p r e e m p t i o n   t a r g e t s .   P r e e m p t i o n   c o n s i d e r s   P o d   p r i o r i t y   a n d   a t t e m p t s   t o   c h o o s e   a   s e t   o f   t a r g e t s   w i t h   t h e   l o w e s t   p r i o r i t y .   H i g h e r - p r i o r i t y   P o d s   a r e   c o n s i d e r e d   f o r   p r e e m p t i o n   o n l y   i f   t h e   r e m o v a l   o f   t h e   l o w e s t   p r i o r i t y   P o d s   i s   n o t   s u f f i c i e n t   t o   a l l o w   t h e   s c h e d u l e r   t o   s c h e d u l e   t h e   p r e e m p t o r   P o d ,   o r   i f   t h e   l o w e s t   p r i o r i t y   P o d s   a r e   p r o t e c t e d   b y   P o d D i s r u p t i o n B u d g e t .   T h e   k u b e l e t   u s e s   P r i o r i t y   t o   d e t e r m i n e   p o d   o r d e r   f o r   n o d e - p r e s s u r e   e v i c t i o n .   Y o u   c a n   u s e   t h e   Q o S   c l a s s   t o   e s t i m a t e   t h e   o r d e r   i n   w h i c h   p o d s   a r e   m o s t   l i k e l y   t o   g e t   e v i c t e d .   T h e   k u b e l e t   r a n k s   p o d s   f o r   e v i c t i o n   b a s e d   o n   t h e   f o l l o w i n g   f a c t o r s :   W h e t h e r   t h e   s t a r v e d   r e s o u r c e   u s a g e   e x c e e d s   r e q u e s t s P o d   P r i o r i t y A m o u n t   o f   r e s o u r c e   u s a g e   r e l a t i v e   t o   r e q u e s t s   S e e   P o d   s e l e c t i o n   f o r   k u b e l e t   e v i c t i o n   f o r   m o r e   d e t a i l s .   k u


Question: What is What's next?

Answer: R e a d   a b o u t   u s i n g   R e s o u r c e Q u o t a s   i n   c o n n e c t i o n   w i t h   P r i o r i t y C l a s s e s :   l i m i t   P r i o r i t y   C l a s s   c o n s u m p t i o n   b y   d e f a u l t L e a r n   a b o u t   P o d   D i s r u p t i o n L e a r n   a b o u t   A P I - i n i t i a t e d   E v i c t i o n L e a r n   a b o u t   N o d e - p r e s s u r e   E v i c t i o n


Question: What is Event Rate Limit Configuration (v1alpha1)?

Answer: Event Rate Limit Configuration (v1alpha1)Resource TypesConfigurationConfigurationConfiguration provides configuration for the EventRateLimit admission controller.FieldDescriptionapiVersionstringeventratelimit.admission.k8s.io/v1alpha1kindstringConfigurationlimits [Required][]Limitlimits are the limits to place on event queries received. Limits can be placed on events received server-wide, per namespace, per user, and per source+object. At least one limit is required.LimitAppears in:ConfigurationLimit is the configuration for a particular limit typeFieldDescriptiontype [Required]LimitTypetype is the type of limit to which this configuration appliesqps [Required]int32qps is the number of event queries per second that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The qps determines how many queries are accepted once the burst amount of queries has been exhausted.burst [Required]int32burst is the burst number of event queries that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The burst determines the maximum size of the allowance granted for a particular bucket. For example, if the burst is 10 and the qps is 3, then the admission control will accept 10 queries before blocking any queries. Every second, 3 more queries will be allowed. If some of that allowance is not used, then it will roll over to the next second, until the maximum allowance of 10 is reached.cacheSizeint32cacheSize is the size of the LRU cache for this type of limit. If a bucket is evicted from the cache, then the allowance for that bucket is reset. If more queries are later received for an evicted bucket, then that bucket will re-enter the cache with a clean slate, giving that bucket a full allowance of burst queries.The default cache size is 4096.If limitType is 'server', then cacheSize is ignored.LimitType(Alias of string)Appears in:LimitLimitType is the type of the limit (e.g., per-namespace)This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does Event Rate Limit Configuration (v1alpha1) work?

Answer: Event Rate Limit Configuration (v1alpha1)Resource TypesConfigurationConfigurationConfiguration provides configuration for the EventRateLimit admission controller.FieldDescriptionapiVersionstringeventratelimit.admission.k8s.io/v1alpha1kindstringConfigurationlimits [Required][]Limitlimits are the limits to place on event queries received. Limits can be placed on events received server-wide, per namespace, per user, and per source+object. At least one limit is required.LimitAppears in:ConfigurationLimit is the configuration for a particular limit typeFieldDescriptiontype [Required]LimitTypetype is the type of limit to which this configuration appliesqps [Required]int32qps is the number of event queries per second that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The qps determines how many queries are accepted once the burst amount of queries has been exhausted.burst [Required]int32burst is the burst number of event queries that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The burst determines the maximum size of the allowance granted for a particular bucket. For example, if the burst is 10 and the qps is 3, then the admission control will accept 10 queries before blocking any queries. Every second, 3 more queries will be allowed. If some of that allowance is not used, then it will roll over to the next second, until the maximum allowance of 10 is reached.cacheSizeint32cacheSize is the size of the LRU cache for this type of limit. If a bucket is evicted from the cache, then the allowance for that bucket is reset. If more queries are later received for an evicted bucket, then that bucket will re-enter the cache with a clean slate, giving that bucket a full allowance of burst queries.The default cache size is 4096.If limitType is 'server', then cacheSize is ignored.LimitType(Alias of string)Appears in:LimitLimitType is the type of the limit (e.g., per-namespace)This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use Event Rate Limit Configuration (v1alpha1)?

Answer: Event Rate Limit Configuration (v1alpha1)Resource TypesConfigurationConfigurationConfiguration provides configuration for the EventRateLimit admission controller.FieldDescriptionapiVersionstringeventratelimit.admission.k8s.io/v1alpha1kindstringConfigurationlimits [Required][]Limitlimits are the limits to place on event queries received. Limits can be placed on events received server-wide, per namespace, per user, and per source+object. At least one limit is required.LimitAppears in:ConfigurationLimit is the configuration for a particular limit typeFieldDescriptiontype [Required]LimitTypetype is the type of limit to which this configuration appliesqps [Required]int32qps is the number of event queries per second that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The qps determines how many queries are accepted once the burst amount of queries has been exhausted.burst [Required]int32burst is the burst number of event queries that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The burst determines the maximum size of the allowance granted for a particular bucket. For example, if the burst is 10 and the qps is 3, then the admission control will accept 10 queries before blocking any queries. Every second, 3 more queries will be allowed. If some of that allowance is not used, then it will roll over to the next second, until the maximum allowance of 10 is reached.cacheSizeint32cacheSize is the size of the LRU cache for this type of limit. If a bucket is evicted from the cache, then the allowance for that bucket is reset. If more queries are later received for an evicted bucket, then that bucket will re-enter the cache with a clean slate, giving that bucket a full allowance of burst queries.The default cache size is 4096.If limitType is 'server', then cacheSize is ignored.LimitType(Alias of string)Appears in:LimitLimitType is the type of the limit (e.g., per-namespace)This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of Event Rate Limit Configuration (v1alpha1)?

Answer: Event Rate Limit Configuration (v1alpha1)Resource TypesConfigurationConfigurationConfiguration provides configuration for the EventRateLimit admission controller.FieldDescriptionapiVersionstringeventratelimit.admission.k8s.io/v1alpha1kindstringConfigurationlimits [Required][]Limitlimits are the limits to place on event queries received. Limits can be placed on events received server-wide, per namespace, per user, and per source+object. At least one limit is required.LimitAppears in:ConfigurationLimit is the configuration for a particular limit typeFieldDescriptiontype [Required]LimitTypetype is the type of limit to which this configuration appliesqps [Required]int32qps is the number of event queries per second that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The qps determines how many queries are accepted once the burst amount of queries has been exhausted.burst [Required]int32burst is the burst number of event queries that are allowed for this type of limit. The qps and burst fields are used together to determine if a particular event query is accepted. The burst determines the maximum size of the allowance granted for a particular bucket. For example, if the burst is 10 and the qps is 3, then the admission control will accept 10 queries before blocking any queries. Every second, 3 more queries will be allowed. If some of that allowance is not used, then it will roll over to the next second, until the maximum allowance of 10 is reached.cacheSizeint32cacheSize is the size of the LRU cache for this type of limit. If a bucket is evicted from the cache, then the allowance for that bucket is reset. If more queries are later received for an evicted bucket, then that bucket will re-enter the cache with a clean slate, giving that bucket a full allowance of burst queries.The default cache size is 4096.If limitType is 'server', then cacheSize is ignored.LimitType(Alias of string)Appears in:LimitLimitType is the type of the limit (e.g., per-namespace)This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is Resource Types?

Answer: C o n f i g u r a t i o n


Question: What is Configuration?

Answer: C o n f i g u r a t i o n   p r o v i d e s   c o n f i g u r a t i o n   f o r   t h e   E v e n t R a t e L i m i t   a d m i s s i o n   c o n t r o l l e r .   l i m i t s   a r e   t h e   l i m i t s   t o   p l a c e   o n   e v e n t   q u e r i e s   r e c e i v e d .   L i m i t s   c a n   b e   p l a c e d   o n   e v e n t s   r e c e i v e d   s e r v e r - w i d e ,   p e r   n a m e s p a c e ,   p e r   u s e r ,   a n d   p e r   s o u r c e + o b j e c t .   A t   l e a s t   o n e   l i m i t   i s   r e q u i r e d .


Question: What is Limit?

Answer: A p p e a r s   i n :   C o n f i g u r a t i o n   L i m i t   i s   t h e   c o n f i g u r a t i o n   f o r   a   p a r t i c u l a r   l i m i t   t y p e   t y p e   i s   t h e   t y p e   o f   l i m i t   t o   w h i c h   t h i s   c o n f i g u r a t i o n   a p p l i e s   q p s   i s   t h e   n u m b e r   o f   e v e n t   q u e r i e s   p e r   s e c o n d   t h a t   a r e   a l l o w e d   f o r   t h i s   t y p e   o f   l i m i t .   T h e   q p s   a n d   b u r s t   f i e l d s   a r e   u s e d   t o g e t h e r   t o   d e t e r m i n e   i f   a   p a r t i c u l a r   e v e n t   q u e r y   i s   a c c e p t e d .   T h e   q p s   d e t e r m i n e s   h o w   m a n y   q u e r i e s   a r e   a c c e p t e d   o n c e   t h e   b u r s t   a m o u n t   o f   q u e r i e s   h a s   b e e n   e x h a u s t e d .   b u r s t   i s   t h e   b u r s t   n u m b e r   o f   e v e n t   q u e r i e s   t h a t   a r e   a l l o w e d   f o r   t h i s   t y p e   o f   l i m i t .   T h e   q p s   a n d   b u r s t   f i e l d s   a r e   u s e d   t o g e t h e r   t o   d e t e r m i n e   i f   a   p a r t i c u l a r   e v e n t   q u e r y   i s   a c c e p t e d .   T h e   b u r s t   d e t e r m i n e s   t h e   m a x i m u m   s i z e   o f   t h e   a l l o w a n c e   g r a n t e d   f o r   a   p a r t i c u l a r   b u c k e t .   F o r   e x a m p l e ,   i f   t h e   b u r s t   i s   1 0   a n d   t h e   q p s   i s   3 ,   t h e n   t h e   a d m i s s i o n   c o n t r o l   w i l l   a c c e p t   1 0   q u e r i e s   b e f o r e   b l o c k i n g   a n y   q u e r i e s .   E v e r y   s e c o n d ,   3   m o r e   q u e r i e s   w i l l   b e   a l l o w e d .   I f   s o m e   o f   t h a t   a l l o w a n c e   i s   n o t   u s e d ,   t h e n   i t   w i l l   r o l l   o v e r   t o   t h e   n e x t   s e c o n d ,   u n t i l   t h e   m a x i m u m   a l l o w a n c e   o f   1 0   i s   r e a c h e d .


Question: What is LimitType?

Answer: ( A l i a s   o f   s t r i n g )   A p p e a r s   i n :   L i m i t   L i m i t T y p e   i s   t h e   t y p e   o f   t h e   l i m i t   ( e . g . ,   p e r - n a m e s p a c e )   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Allocate Devices to Workloads with DRA?

Answer: Allocate Devices to Workloads with DRAFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page shows you how to allocate devices to your Pods by using dynamic resource allocation (DRA). These instructions are for workload operators. Before reading this page, familiarize yourself with how DRA works and with DRA terminology like ResourceClaims and ResourceClaimTemplates. For more information, see Dynamic Resource Allocation (DRA).About device allocation with DRAAs a workload operator, you can claim devices for your workloads by creating ResourceClaims or ResourceClaimTemplates. When you deploy your workload, Kubernetes and the device drivers find available devices, allocate them to your Pods, and place the Pods on nodes that can access those devices.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be version v1.34.To check the version, enter kubectl version.Ensure that your cluster admin has set up DRA, attached devices, and installed drivers. For more information, see Set Up DRA in a Cluster.Identify devices to claimYour cluster administrator or the device drivers create DeviceClasses that define categories of devices. You can claim devices by using Common Expression Language to filter for specific device properties.Get a list of DeviceClasses in the cluster:kubectl get deviceclasses The output is similar to the following:NAME AGE driver.example.com 16m If you get a permission error, you might not have access to get DeviceClasses. Check with your cluster administrator or with the driver provider for available device properties.Claim resourcesYou can request resources from a DeviceClass by using ResourceClaims. To create a ResourceClaim, do one of the following:Manually create a ResourceClaim if you want multiple Pods to share access to the same devices, or if you want a claim to exist beyond the lifetime of a Pod.Use a ResourceClaimTemplate to let Kubernetes generate and manage per-Pod ResourceClaims. Create a ResourceClaimTemplate if you want every Pod to have access to separate devices that have similar configurations. For example, you might want simultaneous access to devices for Pods in a Job that uses parallel execution.If you directly reference a specific ResourceClaim in a Pod, that ResourceClaim must already exist in the cluster. If a referenced ResourceClaim doesn't exist, the Pod remains in a pending state until the ResourceClaim is created. You can reference an auto-generated ResourceClaim in a Pod, but this isn't recommended because auto-generated ResourceClaims are bound to the lifetime of the Pod that tr


Question: How does Allocate Devices to Workloads with DRA work?

Answer: Allocate Devices to Workloads with DRAFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page shows you how to allocate devices to your Pods by using dynamic resource allocation (DRA). These instructions are for workload operators. Before reading this page, familiarize yourself with how DRA works and with DRA terminology like ResourceClaims and ResourceClaimTemplates. For more information, see Dynamic Resource Allocation (DRA).About device allocation with DRAAs a workload operator, you can claim devices for your workloads by creating ResourceClaims or ResourceClaimTemplates. When you deploy your workload, Kubernetes and the device drivers find available devices, allocate them to your Pods, and place the Pods on nodes that can access those devices.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be version v1.34.To check the version, enter kubectl version.Ensure that your cluster admin has set up DRA, attached devices, and installed drivers. For more information, see Set Up DRA in a Cluster.Identify devices to claimYour cluster administrator or the device drivers create DeviceClasses that define categories of devices. You can claim devices by using Common Expression Language to filter for specific device properties.Get a list of DeviceClasses in the cluster:kubectl get deviceclasses The output is similar to the following:NAME AGE driver.example.com 16m If you get a permission error, you might not have access to get DeviceClasses. Check with your cluster administrator or with the driver provider for available device properties.Claim resourcesYou can request resources from a DeviceClass by using ResourceClaims. To create a ResourceClaim, do one of the following:Manually create a ResourceClaim if you want multiple Pods to share access to the same devices, or if you want a claim to exist beyond the lifetime of a Pod.Use a ResourceClaimTemplate to let Kubernetes generate and manage per-Pod ResourceClaims. Create a ResourceClaimTemplate if you want every Pod to have access to separate devices that have similar configurations. For example, you might want simultaneous access to devices for Pods in a Job that uses parallel execution.If you directly reference a specific ResourceClaim in a Pod, that ResourceClaim must already exist in the cluster. If a referenced ResourceClaim doesn't exist, the Pod remains in a pending state until the ResourceClaim is created. You can reference an auto-generated ResourceClaim in a Pod, but this isn't recommended because auto-generated ResourceClaims are bound to the lifetime of the Pod that tr


Question: When would you use Allocate Devices to Workloads with DRA?

Answer: Allocate Devices to Workloads with DRAFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page shows you how to allocate devices to your Pods by using dynamic resource allocation (DRA). These instructions are for workload operators. Before reading this page, familiarize yourself with how DRA works and with DRA terminology like ResourceClaims and ResourceClaimTemplates. For more information, see Dynamic Resource Allocation (DRA).About device allocation with DRAAs a workload operator, you can claim devices for your workloads by creating ResourceClaims or ResourceClaimTemplates. When you deploy your workload, Kubernetes and the device drivers find available devices, allocate them to your Pods, and place the Pods on nodes that can access those devices.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be version v1.34.To check the version, enter kubectl version.Ensure that your cluster admin has set up DRA, attached devices, and installed drivers. For more information, see Set Up DRA in a Cluster.Identify devices to claimYour cluster administrator or the device drivers create DeviceClasses that define categories of devices. You can claim devices by using Common Expression Language to filter for specific device properties.Get a list of DeviceClasses in the cluster:kubectl get deviceclasses The output is similar to the following:NAME AGE driver.example.com 16m If you get a permission error, you might not have access to get DeviceClasses. Check with your cluster administrator or with the driver provider for available device properties.Claim resourcesYou can request resources from a DeviceClass by using ResourceClaims. To create a ResourceClaim, do one of the following:Manually create a ResourceClaim if you want multiple Pods to share access to the same devices, or if you want a claim to exist beyond the lifetime of a Pod.Use a ResourceClaimTemplate to let Kubernetes generate and manage per-Pod ResourceClaims. Create a ResourceClaimTemplate if you want every Pod to have access to separate devices that have similar configurations. For example, you might want simultaneous access to devices for Pods in a Job that uses parallel execution.If you directly reference a specific ResourceClaim in a Pod, that ResourceClaim must already exist in the cluster. If a referenced ResourceClaim doesn't exist, the Pod remains in a pending state until the ResourceClaim is created. You can reference an auto-generated ResourceClaim in a Pod, but this isn't recommended because auto-generated ResourceClaims are bound to the lifetime of the Pod that tr


Question: What are the benefits of Allocate Devices to Workloads with DRA?

Answer: Allocate Devices to Workloads with DRAFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page shows you how to allocate devices to your Pods by using dynamic resource allocation (DRA). These instructions are for workload operators. Before reading this page, familiarize yourself with how DRA works and with DRA terminology like ResourceClaims and ResourceClaimTemplates. For more information, see Dynamic Resource Allocation (DRA).About device allocation with DRAAs a workload operator, you can claim devices for your workloads by creating ResourceClaims or ResourceClaimTemplates. When you deploy your workload, Kubernetes and the device drivers find available devices, allocate them to your Pods, and place the Pods on nodes that can access those devices.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be version v1.34.To check the version, enter kubectl version.Ensure that your cluster admin has set up DRA, attached devices, and installed drivers. For more information, see Set Up DRA in a Cluster.Identify devices to claimYour cluster administrator or the device drivers create DeviceClasses that define categories of devices. You can claim devices by using Common Expression Language to filter for specific device properties.Get a list of DeviceClasses in the cluster:kubectl get deviceclasses The output is similar to the following:NAME AGE driver.example.com 16m If you get a permission error, you might not have access to get DeviceClasses. Check with your cluster administrator or with the driver provider for available device properties.Claim resourcesYou can request resources from a DeviceClass by using ResourceClaims. To create a ResourceClaim, do one of the following:Manually create a ResourceClaim if you want multiple Pods to share access to the same devices, or if you want a claim to exist beyond the lifetime of a Pod.Use a ResourceClaimTemplate to let Kubernetes generate and manage per-Pod ResourceClaims. Create a ResourceClaimTemplate if you want every Pod to have access to separate devices that have similar configurations. For example, you might want simultaneous access to devices for Pods in a Job that uses parallel execution.If you directly reference a specific ResourceClaim in a Pod, that ResourceClaim must already exist in the cluster. If a referenced ResourceClaim doesn't exist, the Pod remains in a pending state until the ResourceClaim is created. You can reference an auto-generated ResourceClaim in a Pod, but this isn't recommended because auto-generated ResourceClaims are bound to the lifetime of the Pod that tr


Question: What is Allocate Devices to Workloads with DRA?

Answer: T h i s   p a g e   s h o w s   y o u   h o w   t o   a l l o c a t e   d e v i c e s   t o   y o u r   P o d s   b y   u s i n g   d y n a m i c   r e s o u r c e   a l l o c a t i o n   ( D R A ) .   T h e s e   i n s t r u c t i o n s   a r e   f o r   w o r k l o a d   o p e r a t o r s .   B e f o r e   r e a d i n g   t h i s   p a g e ,   f a m i l i a r i z e   y o u r s e l f   w i t h   h o w   D R A   w o r k s   a n d   w i t h   D R A   t e r m i n o l o g y   l i k e   R e s o u r c e C l a i m s   a n d   R e s o u r c e C l a i m T e m p l a t e s .   F o r   m o r e   i n f o r m a t i o n ,   s e e   D y n a m i c   R e s o u r c e   A l l o c a t i o n   ( D R A ) .


Question: What is About device allocation with DRA?

Answer: A s   a   w o r k l o a d   o p e r a t o r ,   y o u   c a n   c l a i m   d e v i c e s   f o r   y o u r   w o r k l o a d s   b y   c r e a t i n g   R e s o u r c e C l a i m s   o r   R e s o u r c e C l a i m T e m p l a t e s .   W h e n   y o u   d e p l o y   y o u r   w o r k l o a d ,   K u b e r n e t e s   a n d   t h e   d e v i c e   d r i v e r s   f i n d   a v a i l a b l e   d e v i c e s ,   a l l o c a t e   t h e m   t o   y o u r   P o d s ,   a n d   p l a c e   t h e   P o d s   o n   n o d e s   t h a t   c a n   a c c e s s   t h o s e   d e v i c e s .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   v e r s i o n   v 1 . 3 4 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   E n s u r e   t h a t   y o u r


Question: What is Identify devices to claim?

Answer: Y o u r   c l u s t e r   a d m i n i s t r a t o r   o r   t h e   d e v i c e   d r i v e r s   c r e a t e   D e v i c e C l a s s e s   t h a t   d e f i n e   c a t e g o r i e s   o f   d e v i c e s .   Y o u   c a n   c l a i m   d e v i c e s   b y   u s i n g   C o m m o n   E x p r e s s i o n   L a n g u a g e   t o   f i l t e r   f o r   s p e c i f i c   d e v i c e   p r o p e r t i e s .   G e t   a   l i s t   o f   D e v i c e C l a s s e s   i n   t h e   c l u s t e r :   k u b e c t l   g e t   d e v i c e c l a s s e s   T h e   o u t p u t   i s   s i m i l a r   t o   t h e   f o l l o w i n g :   N A M E   A G E   d r i v e r . e x a m p l e . c o m   1 6 m   I f   y o u   g e t   a   p e r m i s s i o n   e r r o r ,   y o u   m i g h t   n o t   h a v e   a c c e s s   t o   g e t   D e v i c e C l a s s e s .   C h e c k   w i t h   y o u r   c l u s t e r   a d m i n i s t r a t o r   o r   w i t h   t h e   d r i v e r   p r o v i d e r   f o r   a v a i l a b l e   d e v i c e   p r o p e r t i e s .


Question: What is Claim resources?

Answer: Y o u   c a n   r e q u e s t   r e s o u r c e s   f r o m   a   D e v i c e C l a s s   b y   u s i n g   R e s o u r c e C l a i m s .   T o   c r e a t e   a   R e s o u r c e C l a i m ,   d o   o n e   o f   t h e   f o l l o w i n g :   M a n u a l l y   c r e a t e   a   R e s o u r c e C l a i m   i f   y o u   w a n t   m u l t i p l e   P o d s   t o   s h a r e   a c c e s s   t o   t h e   s a m e   d e v i c e s ,   o r   i f   y o u   w a n t   a   c l a i m   t o   e x i s t   b e y o n d   t h e   l i f e t i m e   o f   a   P o d . U s e   a   R e s o u r c e C l a i m T e m p l a t e   t o   l e t   K u b e r n e t e s   g e n e r a t e   a n d   m a n a g e   p e r - P o d   R e s o u r c e C l a i m s .   C r e a t e   a   R e s o u r c e C l a i m T e m p l a t e   i f   y o u   w a n t   e v e r y   P o d   t o   h a v e   a c c e s s   t o   s e p a r a t e   d e v i c e s   t h a t   h a v e   s i m i l a r   c o n f i g u r a t i o n s .   F o r   e x a m p l e ,   y o u   m i g h t   w a n t   s i m u l t a n e o u s   a c c e s s   t o   d e v i c e s   f o r   P o d s   i n   a   J o b   t h a t   u s e s   p a r a l l e l   e x e c u t i o n .   I f   y o u   d i r e c t l y   r e f e r e n c e   a   s p e c i f i c   R e s o u r c e C l a i m   i n   a   P o d ,   t h a t   R e s o u r c e C l a i m   m u s t   a l r e a d y   e x i s t   i n   t h e   c l u s t e r .   I f   a   r e f e r e n c e d   R e s o u r c e C l a i m   d o e s n ' t   e x i s t ,   t h e   P o d   r e m a i n s   i n   a   p e n d i n g   s t a t e   u n t i l   t h e   R e s o u r c e C l a i m   i s   c r e a t e d .   Y o u   c a n   r e f e r e n c e   a n   a u t o - g e n e r a t e d   R e s o u r c e C l a i m   i n   a   P o d ,   b u t   t h i s   i s n ' t   r e c o m m e n d e d   b e c a u s e   a u t o - g e n e r a t e d   R e s o u r c e C l a i m s   a r e   b o u n d   t o   t h e   l i f e t i m e   o f   t h e   P o d   t h a t   t r i g g


Question: What is Request devices in workloads using DRA?

Answer: T o   r e q u e s t   d e v i c e   a l l o c a t i o n ,   s p e c i f y   a   R e s o u r c e C l a i m   o r   a   R e s o u r c e C l a i m T e m p l a t e   i n   t h e   r e s o u r c e C l a i m s   f i e l d   o f   t h e   P o d   s p e c i f i c a t i o n .   T h e n ,   r e q u e s t   a   s p e c i f i c   c l a i m   b y   n a m e   i n   t h e   r e s o u r c e s . c l a i m s   f i e l d   o f   a   c o n t a i n e r   i n   t h a t   P o d .   Y o u   c a n   s p e c i f y   m u l t i p l e   e n t r i e s   i n   t h e   r e s o u r c e C l a i m s   f i e l d   a n d   u s e   s p e c i f i c   c l a i m s   i n   d i f f e r e n t   c o n t a i n e r s .   R e v i e w   t h e   f o l l o w i n g   e x a m p l e   J o b : d r a / d r a - e x a m p l e - j o b . y a m l   a p i V e r s i o n :   b a t c h / v 1   k i n d :   J o b   m e t a d a t a :   n a m e :   e x a m p l e - d r a - j o b   s p e c :   c o m p l e t i o n s :   1 0   p a r a l l e l i s m :   2   t e m p l a t e :   s p e c :   r e s t a r t P o l i c y :   N e v e r   c o n t a i n e r s :   -   n a m e :   c o n t a i n e r 0   i m a g e :   u b u n t u : 2 4 . 0 4   c o m m a n d :   [ " s l e e p " ,   " 9 9 9 9 " ]   r e s o u r c e s :   c l a i m s :   -   n a m e :   s e p a r a t e - g p u - c l a i m   -   n a m e :   c o n t a i n e r 1   i m a g e :   u b u n t u : 2 4 . 0 4   c o m m a n d :   [ " s l e e p " ,   " 9 9 9 9 " ]   r e s o u r c e s :   c l a i m s :   -   n a m e :   s h a r e d - g p u - c l a i m   -   n a m e :   c o n t a i n e r 2   i m a g e :   u b u n t u : 2 4 . 0 4   c o m m a n d :   [ " s l e e p " ,   " 9 9 9 9 " ]   r e s o u r c e s :   c l a i m s :   -   n a m e :   s h a r e d - g p u - c l a i m   r e s o u r c e C l a i m s :   -   n a m e :   s e p a r a t e - g p u - c l a i m   r e s o u r c e C l a i m T e m p l a t e N a m e :   e x a m p l e - r e s o u r c e - c l a i m - t e m p l a t e   -   n a m e :   s h a r e d - g p


Question: What is Clean up?

Answer: T o   d e l e t e   t h e   K u b e r n e t e s   o b j e c t s   t h a t   y o u   c r e a t e d   i n   t h i s   t a s k ,   f o l l o w   t h e s e   s t e p s :   D e l e t e   t h e   e x a m p l e   J o b : k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / d r a - e x a m p l e - j o b . y a m l   T o   d e l e t e   y o u r   r e s o u r c e   c l a i m s ,   r u n   o n e   o f   t h e   f o l l o w i n g   c o m m a n d s : D e l e t e   t h e   R e s o u r c e C l a i m T e m p l a t e : k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m t e m p l a t e . y a m l   D e l e t e   t h e   R e s o u r c e C l a i m : k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m . y a m l   D e l e t e   t h e   e x a m p l e   J o b :   k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / d r a - e x a m p l e - j o b . y a m l   T o   d e l e t e   y o u r   r e s o u r c e   c l a i m s ,   r u n   o n e   o f   t h e   f o l l o w i n g   c o m m a n d s :   D e l e t e   t h e   R e s o u r c e C l a i m T e m p l a t e : k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m t e m p l a t e . y a m l   D e l e t e   t h e   R e s o u r c e C l a i m : k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m . y a m l   D e l e t e   t h e   R e s o u r c e C l a i m T e m p l a t e :   k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m t e m p l a t e . y a m l   D e l e t e   t h e   R e s o u r c e C l a i m :   k u b e c t l   d e l e t e   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d r a / r e s o u r c e c l a i m . y a m l


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   D R A


Question: What is Using Source IP?

Answer: Using Source IPApplications running in a Kubernetes cluster find and communicate with each other, and the outside world, through the Service abstraction. This document explains what happens to the source IP of packets sent to different types of Services, and how you can toggle this behavior according to your needs.Before you beginTerminologyThis document makes use of the following terms:NATNetwork address translationSource NATReplacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node.Destination NATReplacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a PodVIPA virtual IP address, such as the one assigned to every Service in Kuberneteskube-proxyA network daemon that orchestrates Service VIP management on every nodePrerequisitesYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe examples use a small nginx webserver that echoes back the source IP of requests it receives through an HTTP header. You can create it as follows:Note:The image in the following command only runs on AMD64 architectures.kubectl create deployment source-ip-app --image=registry.k8s.io/echoserver:1.10 The output is:deployment.apps/source-ip-app created ObjectivesExpose a simple application through various types of ServicesUnderstand how each Service type handles source IP NATUnderstand the tradeoffs involved in preserving source IPSource IP for Services with Type=ClusterIPPackets sent to ClusterIP from within the cluster are never source NAT'd if you're running kube-proxy in iptables mode, (the default). You can query the kube-proxy mode by fetching http://localhost:10249/proxyMode on the node where kube-proxy is running.kubectl get nodes The output is similar to this:NAME STATUS ROLES AGE VERSION kubernetes-node-6jst Ready <none> 2h v1.13.0 kubernetes-node-cx31 Ready <none> 2h v1.13.0 kubernetes-node-jj1t Ready <none> 2h v1.13.0 Get the proxy mode on one of the nodes (kube-proxy listens on port 10249):# Run this in a shell on the node you want to query. curl http://localhost:10249/proxyMode The output is:iptables You can test source IP preservation by creating a Service over the source IP app:kubectl expose deployment source-ip-app --name=clusterip --port=80 --target-port=8080 The output is:service/clusterip exposed kubectl get svc clusterip The output is similar to:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE clusterip ClusterIP 10.0.170.92 <none> 80/TCP 51s And hitting the ClusterIP from a pod in the same cluster:kubectl run busybox -it --image=busybox:1.28 --restart=Never --rm The output is similar to t


Question: How does Using Source IP work?

Answer: Using Source IPApplications running in a Kubernetes cluster find and communicate with each other, and the outside world, through the Service abstraction. This document explains what happens to the source IP of packets sent to different types of Services, and how you can toggle this behavior according to your needs.Before you beginTerminologyThis document makes use of the following terms:NATNetwork address translationSource NATReplacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node.Destination NATReplacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a PodVIPA virtual IP address, such as the one assigned to every Service in Kuberneteskube-proxyA network daemon that orchestrates Service VIP management on every nodePrerequisitesYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe examples use a small nginx webserver that echoes back the source IP of requests it receives through an HTTP header. You can create it as follows:Note:The image in the following command only runs on AMD64 architectures.kubectl create deployment source-ip-app --image=registry.k8s.io/echoserver:1.10 The output is:deployment.apps/source-ip-app created ObjectivesExpose a simple application through various types of ServicesUnderstand how each Service type handles source IP NATUnderstand the tradeoffs involved in preserving source IPSource IP for Services with Type=ClusterIPPackets sent to ClusterIP from within the cluster are never source NAT'd if you're running kube-proxy in iptables mode, (the default). You can query the kube-proxy mode by fetching http://localhost:10249/proxyMode on the node where kube-proxy is running.kubectl get nodes The output is similar to this:NAME STATUS ROLES AGE VERSION kubernetes-node-6jst Ready <none> 2h v1.13.0 kubernetes-node-cx31 Ready <none> 2h v1.13.0 kubernetes-node-jj1t Ready <none> 2h v1.13.0 Get the proxy mode on one of the nodes (kube-proxy listens on port 10249):# Run this in a shell on the node you want to query. curl http://localhost:10249/proxyMode The output is:iptables You can test source IP preservation by creating a Service over the source IP app:kubectl expose deployment source-ip-app --name=clusterip --port=80 --target-port=8080 The output is:service/clusterip exposed kubectl get svc clusterip The output is similar to:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE clusterip ClusterIP 10.0.170.92 <none> 80/TCP 51s And hitting the ClusterIP from a pod in the same cluster:kubectl run busybox -it --image=busybox:1.28 --restart=Never --rm The output is similar to t


Question: When would you use Using Source IP?

Answer: Using Source IPApplications running in a Kubernetes cluster find and communicate with each other, and the outside world, through the Service abstraction. This document explains what happens to the source IP of packets sent to different types of Services, and how you can toggle this behavior according to your needs.Before you beginTerminologyThis document makes use of the following terms:NATNetwork address translationSource NATReplacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node.Destination NATReplacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a PodVIPA virtual IP address, such as the one assigned to every Service in Kuberneteskube-proxyA network daemon that orchestrates Service VIP management on every nodePrerequisitesYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe examples use a small nginx webserver that echoes back the source IP of requests it receives through an HTTP header. You can create it as follows:Note:The image in the following command only runs on AMD64 architectures.kubectl create deployment source-ip-app --image=registry.k8s.io/echoserver:1.10 The output is:deployment.apps/source-ip-app created ObjectivesExpose a simple application through various types of ServicesUnderstand how each Service type handles source IP NATUnderstand the tradeoffs involved in preserving source IPSource IP for Services with Type=ClusterIPPackets sent to ClusterIP from within the cluster are never source NAT'd if you're running kube-proxy in iptables mode, (the default). You can query the kube-proxy mode by fetching http://localhost:10249/proxyMode on the node where kube-proxy is running.kubectl get nodes The output is similar to this:NAME STATUS ROLES AGE VERSION kubernetes-node-6jst Ready <none> 2h v1.13.0 kubernetes-node-cx31 Ready <none> 2h v1.13.0 kubernetes-node-jj1t Ready <none> 2h v1.13.0 Get the proxy mode on one of the nodes (kube-proxy listens on port 10249):# Run this in a shell on the node you want to query. curl http://localhost:10249/proxyMode The output is:iptables You can test source IP preservation by creating a Service over the source IP app:kubectl expose deployment source-ip-app --name=clusterip --port=80 --target-port=8080 The output is:service/clusterip exposed kubectl get svc clusterip The output is similar to:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE clusterip ClusterIP 10.0.170.92 <none> 80/TCP 51s And hitting the ClusterIP from a pod in the same cluster:kubectl run busybox -it --image=busybox:1.28 --restart=Never --rm The output is similar to t


Question: What are the benefits of Using Source IP?

Answer: Using Source IPApplications running in a Kubernetes cluster find and communicate with each other, and the outside world, through the Service abstraction. This document explains what happens to the source IP of packets sent to different types of Services, and how you can toggle this behavior according to your needs.Before you beginTerminologyThis document makes use of the following terms:NATNetwork address translationSource NATReplacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node.Destination NATReplacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a PodVIPA virtual IP address, such as the one assigned to every Service in Kuberneteskube-proxyA network daemon that orchestrates Service VIP management on every nodePrerequisitesYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThe examples use a small nginx webserver that echoes back the source IP of requests it receives through an HTTP header. You can create it as follows:Note:The image in the following command only runs on AMD64 architectures.kubectl create deployment source-ip-app --image=registry.k8s.io/echoserver:1.10 The output is:deployment.apps/source-ip-app created ObjectivesExpose a simple application through various types of ServicesUnderstand how each Service type handles source IP NATUnderstand the tradeoffs involved in preserving source IPSource IP for Services with Type=ClusterIPPackets sent to ClusterIP from within the cluster are never source NAT'd if you're running kube-proxy in iptables mode, (the default). You can query the kube-proxy mode by fetching http://localhost:10249/proxyMode on the node where kube-proxy is running.kubectl get nodes The output is similar to this:NAME STATUS ROLES AGE VERSION kubernetes-node-6jst Ready <none> 2h v1.13.0 kubernetes-node-cx31 Ready <none> 2h v1.13.0 kubernetes-node-jj1t Ready <none> 2h v1.13.0 Get the proxy mode on one of the nodes (kube-proxy listens on port 10249):# Run this in a shell on the node you want to query. curl http://localhost:10249/proxyMode The output is:iptables You can test source IP preservation by creating a Service over the source IP app:kubectl expose deployment source-ip-app --name=clusterip --port=80 --target-port=8080 The output is:service/clusterip exposed kubectl get svc clusterip The output is similar to:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE clusterip ClusterIP 10.0.170.92 <none> 80/TCP 51s And hitting the ClusterIP from a pod in the same cluster:kubectl run busybox -it --image=busybox:1.28 --restart=Never --rm The output is similar to t


Question: What is Using Source IP?

Answer: A p p l i c a t i o n s   r u n n i n g   i n   a   K u b e r n e t e s   c l u s t e r   f i n d   a n d   c o m m u n i c a t e   w i t h   e a c h   o t h e r ,   a n d   t h e   o u t s i d e   w o r l d ,   t h r o u g h   t h e   S e r v i c e   a b s t r a c t i o n .   T h i s   d o c u m e n t   e x p l a i n s   w h a t   h a p p e n s   t o   t h e   s o u r c e   I P   o f   p a c k e t s   s e n t   t o   d i f f e r e n t   t y p e s   o f   S e r v i c e s ,   a n d   h o w   y o u   c a n   t o g g l e   t h i s   b e h a v i o r   a c c o r d i n g   t o   y o u r   n e e d s .


Question: What is Terminology?

Answer: T h i s   d o c u m e n t   m a k e s   u s e   o f   t h e   f o l l o w i n g   t e r m s :


Question: What is Prerequisites?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T h e   e x a m p l e s   u s e   a   s m a l l   n g i n x   w e b s e r v e r   t h a t   e c h o e s   b a c k   t h e   s o u r c e   I P   o f   r e q u e s t s   i t   r e c e i v e s   t h r o u g h   a n   H T T P   h e a d e r .   Y o u   c a n   c r e a t e   i t   a s   f o l l o w s :


Question: What is Note:?

Answer: k u b e c t l   c r e a t e   d e p l o y m e n t   s o u r c e - i p - a p p   - - i m a g e = r e g i s t r y . k 8 s . i o / e c h o s e r v e r : 1 . 1 0   T h e   o u t p u t   i s :   d e p l o y m e n t . a p p s / s o u r c e - i p - a p p   c r e a t e d


Question: What is Objectives?

Answer: E x p o s e   a   s i m p l e   a p p l i c a t i o n   t h r o u g h   v a r i o u s   t y p e s   o f   S e r v i c e s U n d e r s t a n d   h o w   e a c h   S e r v i c e   t y p e   h a n d l e s   s o u r c e   I P   N A T U n d e r s t a n d   t h e   t r a d e o f f s   i n v o l v e d   i n   p r e s e r v i n g   s o u r c e   I P


Question: What is Source IP for Services with Type=ClusterIP?

Answer: P a c k e t s   s e n t   t o   C l u s t e r I P   f r o m   w i t h i n   t h e   c l u s t e r   a r e   n e v e r   s o u r c e   N A T ' d   i f   y o u ' r e   r u n n i n g   k u b e - p r o x y   i n   i p t a b l e s   m o d e ,   ( t h e   d e f a u l t ) .   Y o u   c a n   q u e r y   t h e   k u b e - p r o x y   m o d e   b y   f e t c h i n g   h t t p : / / l o c a l h o s t : 1 0 2 4 9 / p r o x y M o d e   o n   t h e   n o d e   w h e r e   k u b e - p r o x y   i s   r u n n i n g .   k u b e c t l   g e t   n o d e s   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   N A M E   S T A T U S   R O L E S   A G E   V E R S I O N   k u b e r n e t e s - n o d e - 6 j s t   R e a d y   < n o n e >   2 h   v 1 . 1 3 . 0   k u b e r n e t e s - n o d e - c x 3 1   R e a d y   < n o n e >   2 h   v 1 . 1 3 . 0   k u b e r n e t e s - n o d e - j j 1 t   R e a d y   < n o n e >   2 h   v 1 . 1 3 . 0   G e t   t h e   p r o x y   m o d e   o n   o n e   o f   t h e   n o d e s   ( k u b e - p r o x y   l i s t e n s   o n   p o r t   1 0 2 4 9 ) :   #   R u n   t h i s   i n   a   s h e l l   o n   t h e   n o d e   y o u   w a n t   t o   q u e r y .   c u r l   h t t p : / / l o c a l h o s t : 1 0 2 4 9 / p r o x y M o d e   T h e   o u t p u t   i s :   i p t a b l e s   Y o u   c a n   t e s t   s o u r c e   I P   p r e s e r v a t i o n   b y   c r e a t i n g   a   S e r v i c e   o v e r   t h e   s o u r c e   I P   a p p :   k u b e c t l   e x p o s e   d e p l o y m e n t   s o u r c e - i p - a p p   - - n a m e = c l u s t e r i p   - - p o r t = 8 0   - - t a r g e t - p o r t = 8 0 8 0   T h e   o u t p u t   i s :   s e r v i c e / c l u s t e r i p   e x p o s e d   k u b e c t l   g e t   s v c   c l u s t e r i p   T h e   o u t p u t   i s   s i m i l a r   t o :   N A M E   T Y P E   C L U S T E R - I P   E X T E R N A L - I P   P O R T ( S )   A G E   c l u s t e r i p   C l u s t e r I P   1 0 . 0 . 1 7 0 . 9 2   < n o


Question: What is Source IP for Services with Type=NodePort?

Answer: P a c k e t s   s e n t   t o   S e r v i c e s   w i t h   T y p e = N o d e P o r t   a r e   s o u r c e   N A T ' d   b y   d e f a u l t .   Y o u   c a n   t e s t   t h i s   b y   c r e a t i n g   a   N o d e P o r t   S e r v i c e :   k u b e c t l   e x p o s e   d e p l o y m e n t   s o u r c e - i p - a p p   - - n a m e = n o d e p o r t   - - p o r t = 8 0   - - t a r g e t - p o r t = 8 0 8 0   - - t y p e = N o d e P o r t   T h e   o u t p u t   i s :   s e r v i c e / n o d e p o r t   e x p o s e d   N O D E P O R T = $ ( k u b e c t l   g e t   - o   j s o n p a t h = " { . s p e c . p o r t s [ 0 ] . n o d e P o r t } "   s e r v i c e s   n o d e p o r t )   N O D E S = $ ( k u b e c t l   g e t   n o d e s   - o   j s o n p a t h = ' {   $ . i t e m s [ * ] . s t a t u s . a d d r e s s e s [ ? ( @ . t y p e = = " I n t e r n a l I P " ) ] . a d d r e s s   } ' )   I f   y o u ' r e   r u n n i n g   o n   a   c l o u d   p r o v i d e r ,   y o u   m a y   n e e d   t o   o p e n   u p   a   f i r e w a l l - r u l e   f o r   t h e   n o d e s : n o d e p o r t   r e p o r t e d   a b o v e .   N o w   y o u   c a n   t r y   r e a c h i n g   t h e   S e r v i c e   f r o m   o u t s i d e   t h e   c l u s t e r   t h r o u g h   t h e   n o d e   p o r t   a l l o c a t e d   a b o v e .   f o r   n o d e   i n   $ N O D E S ;   d o   c u r l   - s   $ n o d e : $ N O D E P O R T   |   g r e p   - i   c l i e n t _ a d d r e s s ;   d o n e   T h e   o u t p u t   i s   s i m i l a r   t o :   c l i e n t _ a d d r e s s = 1 0 . 1 8 0 . 1 . 1   c l i e n t _ a d d r e s s = 1 0 . 2 4 0 . 0 . 5   c l i e n t _ a d d r e s s = 1 0 . 2 4 0 . 0 . 3   N o t e   t h a t   t h e s e   a r e   n o t   t h e   c o r r e c t   c l i e n t   I P s ,   t h e y ' r e   c l u s t e r   i n t e r n a l   I P s .   T h i s   i s   w h a t   h a p p e n s :   C l i e n t   s e n d s   p a c k e t   t o   n o d e 2 : n o d e P o r t n o d e 2   r e p l


Question: What is Source IP for Services with Type=LoadBalancer?

Answer: P a c k e t s   s e n t   t o   S e r v i c e s   w i t h   T y p e = L o a d B a l a n c e r   a r e   s o u r c e   N A T ' d   b y   d e f a u l t ,   b e c a u s e   a l l   s c h e d u l a b l e   K u b e r n e t e s   n o d e s   i n   t h e   R e a d y   s t a t e   a r e   e l i g i b l e   f o r   l o a d - b a l a n c e d   t r a f f i c .   S o   i f   p a c k e t s   a r r i v e   a t   a   n o d e   w i t h o u t   a n   e n d p o i n t ,   t h e   s y s t e m   p r o x i e s   i t   t o   a   n o d e   w i t h   a n   e n d p o i n t ,   r e p l a c i n g   t h e   s o u r c e   I P   o n   t h e   p a c k e t   w i t h   t h e   I P   o f   t h e   n o d e   ( a s   d e s c r i b e d   i n   t h e   p r e v i o u s   s e c t i o n ) .   Y o u   c a n   t e s t   t h i s   b y   e x p o s i n g   t h e   s o u r c e - i p - a p p   t h r o u g h   a   l o a d   b a l a n c e r :   k u b e c t l   e x p o s e   d e p l o y m e n t   s o u r c e - i p - a p p   - - n a m e = l o a d b a l a n c e r   - - p o r t = 8 0   - - t a r g e t - p o r t = 8 0 8 0   - - t y p e = L o a d B a l a n c e r   T h e   o u t p u t   i s :   s e r v i c e / l o a d b a l a n c e r   e x p o s e d   P r i n t   o u t   t h e   I P   a d d r e s s e s   o f   t h e   S e r v i c e :   k u b e c t l   g e t   s v c   l o a d b a l a n c e r   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   N A M E   T Y P E   C L U S T E R - I P   E X T E R N A L - I P   P O R T ( S )   A G E   l o a d b a l a n c e r   L o a d B a l a n c e r   1 0 . 0 . 6 5 . 1 1 8   2 0 3 . 0 . 1 1 3 . 1 4 0   8 0 / T C P   5 m   N e x t ,   s e n d   a   r e q u e s t   t o   t h i s   S e r v i c e ' s   e x t e r n a l - i p :   c u r l   2 0 3 . 0 . 1 1 3 . 1 4 0   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   C L I E N T   V A L U E S :   c l i e n t _ a d d r e s s = 1 0 . 2 4 0 . 0 . 5   . . .   H o w e v e r ,   i f   y o u ' r e   r u n n i n g   o n   G o o g l e


Question: What is Cross-platform support?

Answer: O n l y   s o m e   c l o u d   p r o v i d e r s   o f f e r   s u p p o r t   f o r   s o u r c e   I P   p r e s e r v a t i o n   t h r o u g h   S e r v i c e s   w i t h   T y p e = L o a d B a l a n c e r .   T h e   c l o u d   p r o v i d e r   y o u ' r e   r u n n i n g   o n   m i g h t   f u l f i l l   t h e   r e q u e s t   f o r   a   l o a d b a l a n c e r   i n   a   f e w   d i f f e r e n t   w a y s :   W i t h   a   p r o x y   t h a t   t e r m i n a t e s   t h e   c l i e n t   c o n n e c t i o n   a n d   o p e n s   a   n e w   c o n n e c t i o n   t o   y o u r   n o d e s / e n d p o i n t s .   I n   s u c h   c a s e s   t h e   s o u r c e   I P   w i l l   a l w a y s   b e   t h a t   o f   t h e   c l o u d   L B ,   n o t   t h a t   o f   t h e   c l i e n t . W i t h   a   p a c k e t   f o r w a r d e r ,   s u c h   t h a t   r e q u e s t s   f r o m   t h e   c l i e n t   s e n t   t o   t h e   l o a d b a l a n c e r   V I P   e n d   u p   a t   t h e   n o d e   w i t h   t h e   s o u r c e   I P   o f   t h e   c l i e n t ,   n o t   a n   i n t e r m e d i a t e   p r o x y .   W i t h   a   p r o x y   t h a t   t e r m i n a t e s   t h e   c l i e n t   c o n n e c t i o n   a n d   o p e n s   a   n e w   c o n n e c t i o n   t o   y o u r   n o d e s / e n d p o i n t s .   I n   s u c h   c a s e s   t h e   s o u r c e   I P   w i l l   a l w a y s   b e   t h a t   o f   t h e   c l o u d   L B ,   n o t   t h a t   o f   t h e   c l i e n t .   W i t h   a   p a c k e t   f o r w a r d e r ,   s u c h   t h a t   r e q u e s t s   f r o m   t h e   c l i e n t   s e n t   t o   t h e   l o a d b a l a n c e r   V I P   e n d   u p   a t   t h e   n o d e   w i t h   t h e   s o u r c e   I P   o f   t h e   c l i e n t ,   n o t   a n   i n t e r m e d i a t e   p r o x y .   L o a d   b a l a n c e r s   i n   t h e   f i r s t   c a t e g o r y   m u s t   u s e   a n   a g r e e d   u p o n   p r o


Question: What is Cleaning up?

Answer: D e l e t e   t h e   S e r v i c e s :   k u b e c t l   d e l e t e   s v c   - l   a p p = s o u r c e - i p - a p p   D e l e t e   t h e   D e p l o y m e n t ,   R e p l i c a S e t   a n d   P o d :   k u b e c t l   d e l e t e   d e p l o y m e n t   s o u r c e - i p - a p p


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   c o n n e c t i n g   a p p l i c a t i o n s   v i a   s e r v i c e s R e a d   h o w   t o   C r e a t e   a n   E x t e r n a l   L o a d   B a l a n c e r


Question: What is Updating Reference Documentation?

Answer: Updating Reference DocumentationThe topics in this section document how to generate the Kubernetes reference guides.To build the reference documentation, see the following guide:Generating Reference Documentation QuickstartContributing to the Upstream Kubernetes CodeGenerating Reference Documentation for the Kubernetes APIGenerating Reference Documentation for kubectl CommandsGenerating Reference Documentation for MetricsGenerating Reference Pages for Kubernetes Components and Tools


Question: How does Updating Reference Documentation work?

Answer: Updating Reference DocumentationThe topics in this section document how to generate the Kubernetes reference guides.To build the reference documentation, see the following guide:Generating Reference Documentation QuickstartContributing to the Upstream Kubernetes CodeGenerating Reference Documentation for the Kubernetes APIGenerating Reference Documentation for kubectl CommandsGenerating Reference Documentation for MetricsGenerating Reference Pages for Kubernetes Components and Tools


Question: When would you use Updating Reference Documentation?

Answer: Updating Reference DocumentationThe topics in this section document how to generate the Kubernetes reference guides.To build the reference documentation, see the following guide:Generating Reference Documentation QuickstartContributing to the Upstream Kubernetes CodeGenerating Reference Documentation for the Kubernetes APIGenerating Reference Documentation for kubectl CommandsGenerating Reference Documentation for MetricsGenerating Reference Pages for Kubernetes Components and Tools


Question: What are the benefits of Updating Reference Documentation?

Answer: Updating Reference DocumentationThe topics in this section document how to generate the Kubernetes reference guides.To build the reference documentation, see the following guide:Generating Reference Documentation QuickstartContributing to the Upstream Kubernetes CodeGenerating Reference Documentation for the Kubernetes APIGenerating Reference Documentation for kubectl CommandsGenerating Reference Documentation for MetricsGenerating Reference Pages for Kubernetes Components and Tools


Question: What is Updating Reference Documentation?

Answer: T h e   t o p i c s   i n   t h i s   s e c t i o n   d o c u m e n t   h o w   t o   g e n e r a t e   t h e   K u b e r n e t e s   r e f e r e n c e   g u i d e s .   T o   b u i l d   t h e   r e f e r e n c e   d o c u m e n t a t i o n ,   s e e   t h e   f o l l o w i n g   g u i d e :   G e n e r a t i n g   R e f e r e n c e   D o c u m e n t a t i o n   Q u i c k s t a r t


Question: What is Service Accounts?

Answer: Service AccountsLearn about ServiceAccount objects in Kubernetes.This page introduces the ServiceAccount object in Kubernetes, providing information about how service accounts work, use cases, limitations, alternatives, and links to resources for additional guidance.What are service accounts?A service account is a type of non-human account that, in Kubernetes, provides a distinct identity in a Kubernetes cluster. Application Pods, system components, and entities inside and outside the cluster can use a specific ServiceAccount's credentials to identify as that ServiceAccount. This identity is useful in various situations, including authenticating to the API server or implementing identity-based security policies.Service accounts exist as ServiceAccount objects in the API server. Service accounts have the following properties:Namespaced: Each service account is bound to a Kubernetes namespace. Every namespace gets a default ServiceAccount upon creation.Lightweight: Service accounts exist in the cluster and are defined in the Kubernetes API. You can quickly create service accounts to enable specific tasks.Portable: A configuration bundle for a complex containerized workload might include service account definitions for the system's components. The lightweight nature of service accounts and the namespaced identities make the configurations portable.Service accounts are different from user accounts, which are authenticated human users in the cluster. By default, user accounts don't exist in the Kubernetes API server; instead, the API server treats user identities as opaque data. You can authenticate as a user account using multiple methods. Some Kubernetes distributions might add custom extension APIs to represent user accounts in the API server.Comparison between service accounts and usersDescriptionServiceAccountUser or groupLocationKubernetes API (ServiceAccount object)ExternalAccess controlKubernetes RBAC or other authorization mechanismsKubernetes RBAC or other identity and access management mechanismsIntended useWorkloads, automationPeopleDefault service accountsWhen you create a cluster, Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster. The default service accounts in each namespace get no permissions by default other than the default API discovery permissions that Kubernetes grants to all authenticated principals if role-based access control (RBAC) is enabled. If you delete the default ServiceAccount object in a namespace, the control plane replaces it with a new one.If you deploy a Pod in a namespace, and you don't manually assign a ServiceAccount to the Pod, Kubernetes assigns the default ServiceAccount for that namespace to the Pod.Use cases for Kubernetes service accountsAs a general guideline, you can use service accounts to provide identities in the following scenarios:Your Pods need to communicate with the Kubernetes API server, for example in situations such as the following:Pro


Question: How does Service Accounts work?

Answer: Service AccountsLearn about ServiceAccount objects in Kubernetes.This page introduces the ServiceAccount object in Kubernetes, providing information about how service accounts work, use cases, limitations, alternatives, and links to resources for additional guidance.What are service accounts?A service account is a type of non-human account that, in Kubernetes, provides a distinct identity in a Kubernetes cluster. Application Pods, system components, and entities inside and outside the cluster can use a specific ServiceAccount's credentials to identify as that ServiceAccount. This identity is useful in various situations, including authenticating to the API server or implementing identity-based security policies.Service accounts exist as ServiceAccount objects in the API server. Service accounts have the following properties:Namespaced: Each service account is bound to a Kubernetes namespace. Every namespace gets a default ServiceAccount upon creation.Lightweight: Service accounts exist in the cluster and are defined in the Kubernetes API. You can quickly create service accounts to enable specific tasks.Portable: A configuration bundle for a complex containerized workload might include service account definitions for the system's components. The lightweight nature of service accounts and the namespaced identities make the configurations portable.Service accounts are different from user accounts, which are authenticated human users in the cluster. By default, user accounts don't exist in the Kubernetes API server; instead, the API server treats user identities as opaque data. You can authenticate as a user account using multiple methods. Some Kubernetes distributions might add custom extension APIs to represent user accounts in the API server.Comparison between service accounts and usersDescriptionServiceAccountUser or groupLocationKubernetes API (ServiceAccount object)ExternalAccess controlKubernetes RBAC or other authorization mechanismsKubernetes RBAC or other identity and access management mechanismsIntended useWorkloads, automationPeopleDefault service accountsWhen you create a cluster, Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster. The default service accounts in each namespace get no permissions by default other than the default API discovery permissions that Kubernetes grants to all authenticated principals if role-based access control (RBAC) is enabled. If you delete the default ServiceAccount object in a namespace, the control plane replaces it with a new one.If you deploy a Pod in a namespace, and you don't manually assign a ServiceAccount to the Pod, Kubernetes assigns the default ServiceAccount for that namespace to the Pod.Use cases for Kubernetes service accountsAs a general guideline, you can use service accounts to provide identities in the following scenarios:Your Pods need to communicate with the Kubernetes API server, for example in situations such as the following:Pro


Question: When would you use Service Accounts?

Answer: Service AccountsLearn about ServiceAccount objects in Kubernetes.This page introduces the ServiceAccount object in Kubernetes, providing information about how service accounts work, use cases, limitations, alternatives, and links to resources for additional guidance.What are service accounts?A service account is a type of non-human account that, in Kubernetes, provides a distinct identity in a Kubernetes cluster. Application Pods, system components, and entities inside and outside the cluster can use a specific ServiceAccount's credentials to identify as that ServiceAccount. This identity is useful in various situations, including authenticating to the API server or implementing identity-based security policies.Service accounts exist as ServiceAccount objects in the API server. Service accounts have the following properties:Namespaced: Each service account is bound to a Kubernetes namespace. Every namespace gets a default ServiceAccount upon creation.Lightweight: Service accounts exist in the cluster and are defined in the Kubernetes API. You can quickly create service accounts to enable specific tasks.Portable: A configuration bundle for a complex containerized workload might include service account definitions for the system's components. The lightweight nature of service accounts and the namespaced identities make the configurations portable.Service accounts are different from user accounts, which are authenticated human users in the cluster. By default, user accounts don't exist in the Kubernetes API server; instead, the API server treats user identities as opaque data. You can authenticate as a user account using multiple methods. Some Kubernetes distributions might add custom extension APIs to represent user accounts in the API server.Comparison between service accounts and usersDescriptionServiceAccountUser or groupLocationKubernetes API (ServiceAccount object)ExternalAccess controlKubernetes RBAC or other authorization mechanismsKubernetes RBAC or other identity and access management mechanismsIntended useWorkloads, automationPeopleDefault service accountsWhen you create a cluster, Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster. The default service accounts in each namespace get no permissions by default other than the default API discovery permissions that Kubernetes grants to all authenticated principals if role-based access control (RBAC) is enabled. If you delete the default ServiceAccount object in a namespace, the control plane replaces it with a new one.If you deploy a Pod in a namespace, and you don't manually assign a ServiceAccount to the Pod, Kubernetes assigns the default ServiceAccount for that namespace to the Pod.Use cases for Kubernetes service accountsAs a general guideline, you can use service accounts to provide identities in the following scenarios:Your Pods need to communicate with the Kubernetes API server, for example in situations such as the following:Pro


Question: What are the benefits of Service Accounts?

Answer: Service AccountsLearn about ServiceAccount objects in Kubernetes.This page introduces the ServiceAccount object in Kubernetes, providing information about how service accounts work, use cases, limitations, alternatives, and links to resources for additional guidance.What are service accounts?A service account is a type of non-human account that, in Kubernetes, provides a distinct identity in a Kubernetes cluster. Application Pods, system components, and entities inside and outside the cluster can use a specific ServiceAccount's credentials to identify as that ServiceAccount. This identity is useful in various situations, including authenticating to the API server or implementing identity-based security policies.Service accounts exist as ServiceAccount objects in the API server. Service accounts have the following properties:Namespaced: Each service account is bound to a Kubernetes namespace. Every namespace gets a default ServiceAccount upon creation.Lightweight: Service accounts exist in the cluster and are defined in the Kubernetes API. You can quickly create service accounts to enable specific tasks.Portable: A configuration bundle for a complex containerized workload might include service account definitions for the system's components. The lightweight nature of service accounts and the namespaced identities make the configurations portable.Service accounts are different from user accounts, which are authenticated human users in the cluster. By default, user accounts don't exist in the Kubernetes API server; instead, the API server treats user identities as opaque data. You can authenticate as a user account using multiple methods. Some Kubernetes distributions might add custom extension APIs to represent user accounts in the API server.Comparison between service accounts and usersDescriptionServiceAccountUser or groupLocationKubernetes API (ServiceAccount object)ExternalAccess controlKubernetes RBAC or other authorization mechanismsKubernetes RBAC or other identity and access management mechanismsIntended useWorkloads, automationPeopleDefault service accountsWhen you create a cluster, Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster. The default service accounts in each namespace get no permissions by default other than the default API discovery permissions that Kubernetes grants to all authenticated principals if role-based access control (RBAC) is enabled. If you delete the default ServiceAccount object in a namespace, the control plane replaces it with a new one.If you deploy a Pod in a namespace, and you don't manually assign a ServiceAccount to the Pod, Kubernetes assigns the default ServiceAccount for that namespace to the Pod.Use cases for Kubernetes service accountsAs a general guideline, you can use service accounts to provide identities in the following scenarios:Your Pods need to communicate with the Kubernetes API server, for example in situations such as the following:Pro


Question: What is Service Accounts?

Answer: T h i s   p a g e   i n t r o d u c e s   t h e   S e r v i c e A c c o u n t   o b j e c t   i n   K u b e r n e t e s ,   p r o v i d i n g   i n f o r m a t i o n   a b o u t   h o w   s e r v i c e   a c c o u n t s   w o r k ,   u s e   c a s e s ,   l i m i t a t i o n s ,   a l t e r n a t i v e s ,   a n d   l i n k s   t o   r e s o u r c e s   f o r   a d d i t i o n a l   g u i d a n c e .


Question: What is What are service accounts??

Answer: A   s e r v i c e   a c c o u n t   i s   a   t y p e   o f   n o n - h u m a n   a c c o u n t   t h a t ,   i n   K u b e r n e t e s ,   p r o v i d e s   a   d i s t i n c t   i d e n t i t y   i n   a   K u b e r n e t e s   c l u s t e r .   A p p l i c a t i o n   P o d s ,   s y s t e m   c o m p o n e n t s ,   a n d   e n t i t i e s   i n s i d e   a n d   o u t s i d e   t h e   c l u s t e r   c a n   u s e   a   s p e c i f i c   S e r v i c e A c c o u n t ' s   c r e d e n t i a l s   t o   i d e n t i f y   a s   t h a t   S e r v i c e A c c o u n t .   T h i s   i d e n t i t y   i s   u s e f u l   i n   v a r i o u s   s i t u a t i o n s ,   i n c l u d i n g   a u t h e n t i c a t i n g   t o   t h e   A P I   s e r v e r   o r   i m p l e m e n t i n g   i d e n t i t y - b a s e d   s e c u r i t y   p o l i c i e s .   S e r v i c e   a c c o u n t s   e x i s t   a s   S e r v i c e A c c o u n t   o b j e c t s   i n   t h e   A P I   s e r v e r .   S e r v i c e   a c c o u n t s   h a v e   t h e   f o l l o w i n g   p r o p e r t i e s :   N a m e s p a c e d :   E a c h   s e r v i c e   a c c o u n t   i s   b o u n d   t o   a   K u b e r n e t e s   n a m e s p a c e .   E v e r y   n a m e s p a c e   g e t s   a   d e f a u l t   S e r v i c e A c c o u n t   u p o n   c r e a t i o n . L i g h t w e i g h t :   S e r v i c e   a c c o u n t s   e x i s t   i n   t h e   c l u s t e r   a n d   a r e   d e f i n e d   i n   t h e   K u b e r n e t e s   A P I .   Y o u   c a n   q u i c k l y   c r e a t e   s e r v i c e   a c c o u n t s   t o   e n a b l e   s p e c i f i c   t a s k s . P o r t a b l e :   A   c o n f i g u r a t i o n   b u n d l e   f o r   a   c o m p l e x   c o n t a i n e r i z e d   w o r k l o a d   m i g h t   i n c l u d e   s e r v i c e   a c c o u n t   d e f i n i t i o n s   f o r   t h e   s y s t e m ' s   c o m p o n e n t s .   T h e   l i g h t w e i g h t   n a t u r e   o f   s e r v


Question: What is Default service accounts?

Answer: W h e n   y o u   c r e a t e   a   c l u s t e r ,   K u b e r n e t e s   a u t o m a t i c a l l y   c r e a t e s   a   S e r v i c e A c c o u n t   o b j e c t   n a m e d   d e f a u l t   f o r   e v e r y   n a m e s p a c e   i n   y o u r   c l u s t e r .   T h e   d e f a u l t   s e r v i c e   a c c o u n t s   i n   e a c h   n a m e s p a c e   g e t   n o   p e r m i s s i o n s   b y   d e f a u l t   o t h e r   t h a n   t h e   d e f a u l t   A P I   d i s c o v e r y   p e r m i s s i o n s   t h a t   K u b e r n e t e s   g r a n t s   t o   a l l   a u t h e n t i c a t e d   p r i n c i p a l s   i f   r o l e - b a s e d   a c c e s s   c o n t r o l   ( R B A C )   i s   e n a b l e d .   I f   y o u   d e l e t e   t h e   d e f a u l t   S e r v i c e A c c o u n t   o b j e c t   i n   a   n a m e s p a c e ,   t h e   c o n t r o l   p l a n e   r e p l a c e s   i t   w i t h   a   n e w   o n e .   I f   y o u   d e p l o y   a   P o d   i n   a   n a m e s p a c e ,   a n d   y o u   d o n ' t   m a n u a l l y   a s s i g n   a   S e r v i c e A c c o u n t   t o   t h e   P o d ,   K u b e r n e t e s   a s s i g n s   t h e   d e f a u l t   S e r v i c e A c c o u n t   f o r   t h a t   n a m e s p a c e   t o   t h e   P o d .


Question: What is Use cases for Kubernetes service accounts?

Answer: A s   a   g e n e r a l   g u i d e l i n e ,   y o u   c a n   u s e   s e r v i c e   a c c o u n t s   t o   p r o v i d e   i d e n t i t i e s   i n   t h e   f o l l o w i n g   s c e n a r i o s :   Y o u r   P o d s   n e e d   t o   c o m m u n i c a t e   w i t h   t h e   K u b e r n e t e s   A P I   s e r v e r ,   f o r   e x a m p l e   i n   s i t u a t i o n s   s u c h   a s   t h e   f o l l o w i n g : P r o v i d i n g   r e a d - o n l y   a c c e s s   t o   s e n s i t i v e   i n f o r m a t i o n   s t o r e d   i n   S e c r e t s . G r a n t i n g   c r o s s - n a m e s p a c e   a c c e s s ,   s u c h   a s   a l l o w i n g   a   P o d   i n   n a m e s p a c e   e x a m p l e   t o   r e a d ,   l i s t ,   a n d   w a t c h   f o r   L e a s e   o b j e c t s   i n   t h e   k u b e - n o d e - l e a s e   n a m e s p a c e . Y o u r   P o d s   n e e d   t o   c o m m u n i c a t e   w i t h   a n   e x t e r n a l   s e r v i c e .   F o r   e x a m p l e ,   a   w o r k l o a d   P o d   r e q u i r e s   a n   i d e n t i t y   f o r   a   c o m m e r c i a l l y   a v a i l a b l e   c l o u d   A P I ,   a n d   t h e   c o m m e r c i a l   p r o v i d e r   a l l o w s   c o n f i g u r i n g   a   s u i t a b l e   t r u s t   r e l a t i o n s h i p . A u t h e n t i c a t i n g   t o   a   p r i v a t e   i m a g e   r e g i s t r y   u s i n g   a n   i m a g e P u l l S e c r e t . A n   e x t e r n a l   s e r v i c e   n e e d s   t o   c o m m u n i c a t e   w i t h   t h e   K u b e r n e t e s   A P I   s e r v e r .   F o r   e x a m p l e ,   a u t h e n t i c a t i n g   t o   t h e   c l u s t e r   a s   p a r t   o f   a   C I / C D   p i p e l i n e . Y o u   u s e   t h i r d - p a r t y   s e c u r i t y   s o f t w a r e   i n   y o u r   c l u s t e r   t h a t   r e l i e s   o n   t h e   S e r v i c e A c c o u n t   i d e n t i t y   o f   d i f f e r e n t   P o d s   t o   g r o u p   t h o s e


Question: What is How to use service accounts?

Answer: T o   u s e   a   K u b e r n e t e s   s e r v i c e   a c c o u n t ,   y o u   d o   t h e   f o l l o w i n g :   C r e a t e   a   S e r v i c e A c c o u n t   o b j e c t   u s i n g   a   K u b e r n e t e s   c l i e n t   l i k e   k u b e c t l   o r   a   m a n i f e s t   t h a t   d e f i n e s   t h e   o b j e c t . G r a n t   p e r m i s s i o n s   t o   t h e   S e r v i c e A c c o u n t   o b j e c t   u s i n g   a n   a u t h o r i z a t i o n   m e c h a n i s m   s u c h   a s   R B A C . A s s i g n   t h e   S e r v i c e A c c o u n t   o b j e c t   t o   P o d s   d u r i n g   P o d   c r e a t i o n . I f   y o u ' r e   u s i n g   t h e   i d e n t i t y   f r o m   a n   e x t e r n a l   s e r v i c e ,   r e t r i e v e   t h e   S e r v i c e A c c o u n t   t o k e n   a n d   u s e   i t   f r o m   t h a t   s e r v i c e   i n s t e a d .   C r e a t e   a   S e r v i c e A c c o u n t   o b j e c t   u s i n g   a   K u b e r n e t e s   c l i e n t   l i k e   k u b e c t l   o r   a   m a n i f e s t   t h a t   d e f i n e s   t h e   o b j e c t .   G r a n t   p e r m i s s i o n s   t o   t h e   S e r v i c e A c c o u n t   o b j e c t   u s i n g   a n   a u t h o r i z a t i o n   m e c h a n i s m   s u c h   a s   R B A C .   A s s i g n   t h e   S e r v i c e A c c o u n t   o b j e c t   t o   P o d s   d u r i n g   P o d   c r e a t i o n .   I f   y o u ' r e   u s i n g   t h e   i d e n t i t y   f r o m   a n   e x t e r n a l   s e r v i c e ,   r e t r i e v e   t h e   S e r v i c e A c c o u n t   t o k e n   a n d   u s e   i t   f r o m   t h a t   s e r v i c e   i n s t e a d .   F o r   i n s t r u c t i o n s ,   r e f e r   t o   C o n f i g u r e   S e r v i c e   A c c o u n t s   f o r   P o d s .


Question: What is Grant permissions to a ServiceAccount?

Answer: Y o u   c a n   u s e   t h e   b u i l t - i n   K u b e r n e t e s   r o l e - b a s e d   a c c e s s   c o n t r o l   ( R B A C )   m e c h a n i s m   t o   g r a n t   t h e   m i n i m u m   p e r m i s s i o n s   r e q u i r e d   b y   e a c h   s e r v i c e   a c c o u n t .   Y o u   c r e a t e   a   r o l e ,   w h i c h   g r a n t s   a c c e s s ,   a n d   t h e n   b i n d   t h e   r o l e   t o   y o u r   S e r v i c e A c c o u n t .   R B A C   l e t s   y o u   d e f i n e   a   m i n i m u m   s e t   o f   p e r m i s s i o n s   s o   t h a t   t h e   s e r v i c e   a c c o u n t   p e r m i s s i o n s   f o l l o w   t h e   p r i n c i p l e   o f   l e a s t   p r i v i l e g e .   P o d s   t h a t   u s e   t h a t   s e r v i c e   a c c o u n t   d o n ' t   g e t   m o r e   p e r m i s s i o n s   t h a n   a r e   r e q u i r e d   t o   f u n c t i o n   c o r r e c t l y .   F o r   i n s t r u c t i o n s ,   r e f e r   t o   S e r v i c e A c c o u n t   p e r m i s s i o n s .