Question: What is Config and Storage Resources?

Answer: Config and Storage ResourcesConfigMapConfigMap holds configuration data for pods to consume.SecretSecret holds secret data of a certain type.CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.CSINodeCSINode holds information about all CSI drivers installed on a node.CSIStorageCapacityCSIStorageCapacity stores the result of one CSI GetCapacity call.PersistentVolumeClaimPersistentVolumeClaim is a user's request for and claim to a persistent volume.PersistentVolumePersistentVolume (PV) is a storage resource provisioned by an administrator.StorageClassStorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.StorageVersionMigration v1alpha1StorageVersionMigration represents a migration of stored data to the latest storage version.VolumeVolume represents a named volume in a pod that may be accessed by any container in the pod.VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttributesClassVolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does Config and Storage Resources work?

Answer: Config and Storage ResourcesConfigMapConfigMap holds configuration data for pods to consume.SecretSecret holds secret data of a certain type.CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.CSINodeCSINode holds information about all CSI drivers installed on a node.CSIStorageCapacityCSIStorageCapacity stores the result of one CSI GetCapacity call.PersistentVolumeClaimPersistentVolumeClaim is a user's request for and claim to a persistent volume.PersistentVolumePersistentVolume (PV) is a storage resource provisioned by an administrator.StorageClassStorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.StorageVersionMigration v1alpha1StorageVersionMigration represents a migration of stored data to the latest storage version.VolumeVolume represents a named volume in a pod that may be accessed by any container in the pod.VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttributesClassVolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use Config and Storage Resources?

Answer: Config and Storage ResourcesConfigMapConfigMap holds configuration data for pods to consume.SecretSecret holds secret data of a certain type.CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.CSINodeCSINode holds information about all CSI drivers installed on a node.CSIStorageCapacityCSIStorageCapacity stores the result of one CSI GetCapacity call.PersistentVolumeClaimPersistentVolumeClaim is a user's request for and claim to a persistent volume.PersistentVolumePersistentVolume (PV) is a storage resource provisioned by an administrator.StorageClassStorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.StorageVersionMigration v1alpha1StorageVersionMigration represents a migration of stored data to the latest storage version.VolumeVolume represents a named volume in a pod that may be accessed by any container in the pod.VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttributesClassVolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of Config and Storage Resources?

Answer: Config and Storage ResourcesConfigMapConfigMap holds configuration data for pods to consume.SecretSecret holds secret data of a certain type.CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.CSINodeCSINode holds information about all CSI drivers installed on a node.CSIStorageCapacityCSIStorageCapacity stores the result of one CSI GetCapacity call.PersistentVolumeClaimPersistentVolumeClaim is a user's request for and claim to a persistent volume.PersistentVolumePersistentVolume (PV) is a storage resource provisioned by an administrator.StorageClassStorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.StorageVersionMigration v1alpha1StorageVersionMigration represents a migration of stored data to the latest storage version.VolumeVolume represents a named volume in a pod that may be accessed by any container in the pod.VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttributesClassVolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is ConfigMap?

Answer: C o n f i g M a p   h o l d s   c o n f i g u r a t i o n   d a t a   f o r   p o d s   t o   c o n s u m e .


Question: What is Secret?

Answer: S e c r e t   h o l d s   s e c r e t   d a t a   o f   a   c e r t a i n   t y p e .


Question: What is CSIDriver?

Answer: C S I D r i v e r   c a p t u r e s   i n f o r m a t i o n   a b o u t   a   C o n t a i n e r   S t o r a g e   I n t e r f a c e   ( C S I )   v o l u m e   d r i v e r   d e p l o y e d   o n   t h e   c l u s t e r .


Question: What is CSINode?

Answer: C S I N o d e   h o l d s   i n f o r m a t i o n   a b o u t   a l l   C S I   d r i v e r s   i n s t a l l e d   o n   a   n o d e .


Question: What is CSIStorageCapacity?

Answer: C S I S t o r a g e C a p a c i t y   s t o r e s   t h e   r e s u l t   o f   o n e   C S I   G e t C a p a c i t y   c a l l .


Question: What is PersistentVolumeClaim?

Answer: P e r s i s t e n t V o l u m e C l a i m   i s   a   u s e r ' s   r e q u e s t   f o r   a n d   c l a i m   t o   a   p e r s i s t e n t   v o l u m e .


Question: What is PersistentVolume?

Answer: P e r s i s t e n t V o l u m e   ( P V )   i s   a   s t o r a g e   r e s o u r c e   p r o v i s i o n e d   b y   a n   a d m i n i s t r a t o r .


Question: What is StorageClass?

Answer: S t o r a g e C l a s s   d e s c r i b e s   t h e   p a r a m e t e r s   f o r   a   c l a s s   o f   s t o r a g e   f o r   w h i c h   P e r s i s t e n t V o l u m e s   c a n   b e   d y n a m i c a l l y   p r o v i s i o n e d .


Question: What is StorageVersionMigration v1alpha1?

Answer: S t o r a g e V e r s i o n M i g r a t i o n   r e p r e s e n t s   a   m i g r a t i o n   o f   s t o r e d   d a t a   t o   t h e   l a t e s t   s t o r a g e   v e r s i o n .


Question: What is Volume?

Answer: V o l u m e   r e p r e s e n t s   a   n a m e d   v o l u m e   i n   a   p o d   t h a t   m a y   b e   a c c e s s e d   b y   a n y   c o n t a i n e r   i n   t h e   p o d .


Question: What is VolumeAttachment?

Answer: V o l u m e A t t a c h m e n t   c a p t u r e s   t h e   i n t e n t   t o   a t t a c h   o r   d e t a c h   t h e   s p e c i f i e d   v o l u m e   t o / f r o m   t h e   s p e c i f i e d   n o d e .


Question: What is VolumeAttributesClass?

Answer: V o l u m e A t t r i b u t e s C l a s s   r e p r e s e n t s   a   s p e c i f i c a t i o n   o f   m u t a b l e   v o l u m e   a t t r i b u t e s   d e f i n e d   b y   t h e   C S I   d r i v e r .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Advertise Extended Resources for a Node?

Answer: Advertise Extended Resources for a NodeThis page shows how to specify extended resources for a Node. Extended resources allow cluster administrators to advertise node-level resources that would otherwise be unknown to Kubernetes.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Get the names of your Nodeskubectl get nodes Choose one of your Nodes to use for this exercise.Advertise a new extended resource on one of your NodesTo advertise a new extended resource on a Node, send an HTTP PATCH request to the Kubernetes API server. For example, suppose one of your Nodes has four dongles attached. Here's an example of a PATCH request that advertises four dongle resources for your Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4" } ] Note that Kubernetes does not need to know what a dongle is or what a dongle is for. The preceding PATCH request tells Kubernetes that your Node has four things that you call dongles.Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Note:In the preceding request, ~1 is the encoding for the character / in the patch path. The operation path value in JSON-Patch is interpreted as a JSON-Pointer. For more details, see IETF RFC 6901, section 3.The output shows that the Node has a capacity of 4 dongles:"capacity": { "cpu": "2", "memory": "2049008Ki", "example.com/dongle": "4", Describe your Node:kubectl describe node <your-node-name> Once again, the output shows the dongle resource:Capacity: cpu: 2 memory: 2049008Ki example.com/dongle: 4 Now, application developers can create Pods that request a certain number of dongles. See Assign Extended Resources to a Container.DiscussionExtended resources are similar to memory and CPU resources. For example, just as a Node has a certain amount of memory and CPU to be shared by all components running on the Node, it can have a certain number of dongles to be shared by all components running on the Node. And just as application developers can create Pods that request a certain amount of memory and CPU, they can create Pods th


Question: How does Advertise Extended Resources for a Node work?

Answer: Advertise Extended Resources for a NodeThis page shows how to specify extended resources for a Node. Extended resources allow cluster administrators to advertise node-level resources that would otherwise be unknown to Kubernetes.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Get the names of your Nodeskubectl get nodes Choose one of your Nodes to use for this exercise.Advertise a new extended resource on one of your NodesTo advertise a new extended resource on a Node, send an HTTP PATCH request to the Kubernetes API server. For example, suppose one of your Nodes has four dongles attached. Here's an example of a PATCH request that advertises four dongle resources for your Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4" } ] Note that Kubernetes does not need to know what a dongle is or what a dongle is for. The preceding PATCH request tells Kubernetes that your Node has four things that you call dongles.Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Note:In the preceding request, ~1 is the encoding for the character / in the patch path. The operation path value in JSON-Patch is interpreted as a JSON-Pointer. For more details, see IETF RFC 6901, section 3.The output shows that the Node has a capacity of 4 dongles:"capacity": { "cpu": "2", "memory": "2049008Ki", "example.com/dongle": "4", Describe your Node:kubectl describe node <your-node-name> Once again, the output shows the dongle resource:Capacity: cpu: 2 memory: 2049008Ki example.com/dongle: 4 Now, application developers can create Pods that request a certain number of dongles. See Assign Extended Resources to a Container.DiscussionExtended resources are similar to memory and CPU resources. For example, just as a Node has a certain amount of memory and CPU to be shared by all components running on the Node, it can have a certain number of dongles to be shared by all components running on the Node. And just as application developers can create Pods that request a certain amount of memory and CPU, they can create Pods th


Question: When would you use Advertise Extended Resources for a Node?

Answer: Advertise Extended Resources for a NodeThis page shows how to specify extended resources for a Node. Extended resources allow cluster administrators to advertise node-level resources that would otherwise be unknown to Kubernetes.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Get the names of your Nodeskubectl get nodes Choose one of your Nodes to use for this exercise.Advertise a new extended resource on one of your NodesTo advertise a new extended resource on a Node, send an HTTP PATCH request to the Kubernetes API server. For example, suppose one of your Nodes has four dongles attached. Here's an example of a PATCH request that advertises four dongle resources for your Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4" } ] Note that Kubernetes does not need to know what a dongle is or what a dongle is for. The preceding PATCH request tells Kubernetes that your Node has four things that you call dongles.Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Note:In the preceding request, ~1 is the encoding for the character / in the patch path. The operation path value in JSON-Patch is interpreted as a JSON-Pointer. For more details, see IETF RFC 6901, section 3.The output shows that the Node has a capacity of 4 dongles:"capacity": { "cpu": "2", "memory": "2049008Ki", "example.com/dongle": "4", Describe your Node:kubectl describe node <your-node-name> Once again, the output shows the dongle resource:Capacity: cpu: 2 memory: 2049008Ki example.com/dongle: 4 Now, application developers can create Pods that request a certain number of dongles. See Assign Extended Resources to a Container.DiscussionExtended resources are similar to memory and CPU resources. For example, just as a Node has a certain amount of memory and CPU to be shared by all components running on the Node, it can have a certain number of dongles to be shared by all components running on the Node. And just as application developers can create Pods that request a certain amount of memory and CPU, they can create Pods th


Question: What are the benefits of Advertise Extended Resources for a Node?

Answer: Advertise Extended Resources for a NodeThis page shows how to specify extended resources for a Node. Extended resources allow cluster administrators to advertise node-level resources that would otherwise be unknown to Kubernetes.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Get the names of your Nodeskubectl get nodes Choose one of your Nodes to use for this exercise.Advertise a new extended resource on one of your NodesTo advertise a new extended resource on a Node, send an HTTP PATCH request to the Kubernetes API server. For example, suppose one of your Nodes has four dongles attached. Here's an example of a PATCH request that advertises four dongle resources for your Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4" } ] Note that Kubernetes does not need to know what a dongle is or what a dongle is for. The preceding PATCH request tells Kubernetes that your Node has four things that you call dongles.Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Note:In the preceding request, ~1 is the encoding for the character / in the patch path. The operation path value in JSON-Patch is interpreted as a JSON-Pointer. For more details, see IETF RFC 6901, section 3.The output shows that the Node has a capacity of 4 dongles:"capacity": { "cpu": "2", "memory": "2049008Ki", "example.com/dongle": "4", Describe your Node:kubectl describe node <your-node-name> Once again, the output shows the dongle resource:Capacity: cpu: 2 memory: 2049008Ki example.com/dongle: 4 Now, application developers can create Pods that request a certain number of dongles. See Assign Extended Resources to a Container.DiscussionExtended resources are similar to memory and CPU resources. For example, just as a Node has a certain amount of memory and CPU to be shared by all components running on the Node, it can have a certain number of dongles to be shared by all components running on the Node. And just as application developers can create Pods that request a certain amount of memory and CPU, they can create Pods th


Question: What is Advertise Extended Resources for a Node?

Answer: T h i s   p a g e   s h o w s   h o w   t o   s p e c i f y   e x t e n d e d   r e s o u r c e s   f o r   a   N o d e .   E x t e n d e d   r e s o u r c e s   a l l o w   c l u s t e r   a d m i n i s t r a t o r s   t o   a d v e r t i s e   n o d e - l e v e l   r e s o u r c e s   t h a t   w o u l d   o t h e r w i s e   b e   u n k n o w n   t o   K u b e r n e t e s .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Get the names of your Nodes?

Answer: k u b e c t l   g e t   n o d e s   C h o o s e   o n e   o f   y o u r   N o d e s   t o   u s e   f o r   t h i s   e x e r c i s e .


Question: What is Advertise a new extended resource on one of your Nodes?

Answer: T o   a d v e r t i s e   a   n e w   e x t e n d e d   r e s o u r c e   o n   a   N o d e ,   s e n d   a n   H T T P   P A T C H   r e q u e s t   t o   t h e   K u b e r n e t e s   A P I   s e r v e r .   F o r   e x a m p l e ,   s u p p o s e   o n e   o f   y o u r   N o d e s   h a s   f o u r   d o n g l e s   a t t a c h e d .   H e r e ' s   a n   e x a m p l e   o f   a   P A T C H   r e q u e s t   t h a t   a d v e r t i s e s   f o u r   d o n g l e   r e s o u r c e s   f o r   y o u r   N o d e .   P A T C H   / a p i / v 1 / n o d e s / < y o u r - n o d e - n a m e > / s t a t u s   H T T P / 1 . 1   A c c e p t :   a p p l i c a t i o n / j s o n   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n - p a t c h + j s o n   H o s t :   k 8 s - m a s t e r : 8 0 8 0   [   {   " o p " :   " a d d " ,   " p a t h " :   " / s t a t u s / c a p a c i t y / e x a m p l e . c o m ~ 1 d o n g l e " ,   " v a l u e " :   " 4 "   }   ]   N o t e   t h a t   K u b e r n e t e s   d o e s   n o t   n e e d   t o   k n o w   w h a t   a   d o n g l e   i s   o r   w h a t   a   d o n g l e   i s   f o r .   T h e   p r e c e d i n g   P A T C H   r e q u e s t   t e l l s   K u b e r n e t e s   t h a t   y o u r   N o d e   h a s   f o u r   t h i n g s   t h a t   y o u   c a l l   d o n g l e s .   S t a r t   a   p r o x y ,   s o   t h a t   y o u   c a n   e a s i l y   s e n d   r e q u e s t s   t o   t h e   K u b e r n e t e s   A P I   s e r v e r :   k u b e c t l   p r o x y   I n   a n o t h e r   c o m m a n d   w i n d o w ,   s e n d   t h e   H T T P   P A T C H   r e q u e s t .   R e p l a c e   < y o u r - n o d e - n a m e >   w i t h   t h e   n a m e   o f   y o u r   N o d e :   c u r l   - - h e a d e r   " C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n - p a t c h + j s o n "   \   - - r e q u e s t   P A T C H   \   - - d a t a   ' [ { " o p " :   " a d d " ,   " p a t h " :   " / s t a t u s / c a p a c i t y


Question: What is Note:?

Answer: T h e   o u t p u t   s h o w s   t h a t   t h e   N o d e   h a s   a   c a p a c i t y   o f   4   d o n g l e s :   " c a p a c i t y " :   {   " c p u " :   " 2 " ,   " m e m o r y " :   " 2 0 4 9 0 0 8 K i " ,   " e x a m p l e . c o m / d o n g l e " :   " 4 " ,   D e s c r i b e   y o u r   N o d e :   k u b e c t l   d e s c r i b e   n o d e   < y o u r - n o d e - n a m e >   O n c e   a g a i n ,   t h e   o u t p u t   s h o w s   t h e   d o n g l e   r e s o u r c e :   C a p a c i t y :   c p u :   2   m e m o r y :   2 0 4 9 0 0 8 K i   e x a m p l e . c o m / d o n g l e :   4   N o w ,   a p p l i c a t i o n   d e v e l o p e r s   c a n   c r e a t e   P o d s   t h a t   r e q u e s t   a   c e r t a i n   n u m b e r   o f   d o n g l e s .   S e e   A s s i g n   E x t e n d e d   R e s o u r c e s   t o   a   C o n t a i n e r .


Question: What is Discussion?

Answer: E x t e n d e d   r e s o u r c e s   a r e   s i m i l a r   t o   m e m o r y   a n d   C P U   r e s o u r c e s .   F o r   e x a m p l e ,   j u s t   a s   a   N o d e   h a s   a   c e r t a i n   a m o u n t   o f   m e m o r y   a n d   C P U   t o   b e   s h a r e d   b y   a l l   c o m p o n e n t s   r u n n i n g   o n   t h e   N o d e ,   i t   c a n   h a v e   a   c e r t a i n   n u m b e r   o f   d o n g l e s   t o   b e   s h a r e d   b y   a l l   c o m p o n e n t s   r u n n i n g   o n   t h e   N o d e .   A n d   j u s t   a s   a p p l i c a t i o n   d e v e l o p e r s   c a n   c r e a t e   P o d s   t h a t   r e q u e s t   a   c e r t a i n   a m o u n t   o f   m e m o r y   a n d   C P U ,   t h e y   c a n   c r e a t e   P o d s   t h a t   r e q u e s t   a   c e r t a i n   n u m b e r   o f   d o n g l e s .   E x t e n d e d   r e s o u r c e s   a r e   o p a q u e   t o   K u b e r n e t e s ;   K u b e r n e t e s   d o e s   n o t   k n o w   a n y t h i n g   a b o u t   w h a t   t h e y   a r e .   K u b e r n e t e s   k n o w s   o n l y   t h a t   a   N o d e   h a s   a   c e r t a i n   n u m b e r   o f   t h e m .   E x t e n d e d   r e s o u r c e s   m u s t   b e   a d v e r t i s e d   i n   i n t e g e r   a m o u n t s .   F o r   e x a m p l e ,   a   N o d e   c a n   a d v e r t i s e   f o u r   d o n g l e s ,   b u t   n o t   4 . 5   d o n g l e s .


Question: What is Storage example?

Answer: S u p p o s e   a   N o d e   h a s   8 0 0   G i B   o f   a   s p e c i a l   k i n d   o f   d i s k   s t o r a g e .   Y o u   c o u l d   c r e a t e   a   n a m e   f o r   t h e   s p e c i a l   s t o r a g e ,   s a y   e x a m p l e . c o m / s p e c i a l - s t o r a g e .   T h e n   y o u   c o u l d   a d v e r t i s e   i t   i n   c h u n k s   o f   a   c e r t a i n   s i z e ,   s a y   1 0 0   G i B .   I n   t h a t   c a s e ,   y o u r   N o d e   w o u l d   a d v e r t i s e   t h a t   i t   h a s   e i g h t   r e s o u r c e s   o f   t y p e   e x a m p l e . c o m / s p e c i a l - s t o r a g e .   C a p a c i t y :   . . .   e x a m p l e . c o m / s p e c i a l - s t o r a g e :   8   I f   y o u   w a n t   t o   a l l o w   a r b i t r a r y   r e q u e s t s   f o r   s p e c i a l   s t o r a g e ,   y o u   c o u l d   a d v e r t i s e   s p e c i a l   s t o r a g e   i n   c h u n k s   o f   s i z e   1   b y t e .   I n   t h a t   c a s e ,   y o u   w o u l d   a d v e r t i s e   8 0 0 G i   r e s o u r c e s   o f   t y p e   e x a m p l e . c o m / s p e c i a l - s t o r a g e .   C a p a c i t y :   . . .   e x a m p l e . c o m / s p e c i a l - s t o r a g e :   8 0 0 G i   T h e n   a   C o n t a i n e r   c o u l d   r e q u e s t   a n y   n u m b e r   o f   b y t e s   o f   s p e c i a l   s t o r a g e ,   u p   t o   8 0 0 G i .


Question: What is Clean up?

Answer: H e r e   i s   a   P A T C H   r e q u e s t   t h a t   r e m o v e s   t h e   d o n g l e   a d v e r t i s e m e n t   f r o m   a   N o d e .   P A T C H   / a p i / v 1 / n o d e s / < y o u r - n o d e - n a m e > / s t a t u s   H T T P / 1 . 1   A c c e p t :   a p p l i c a t i o n / j s o n   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n - p a t c h + j s o n   H o s t :   k 8 s - m a s t e r : 8 0 8 0   [   {   " o p " :   " r e m o v e " ,   " p a t h " :   " / s t a t u s / c a p a c i t y / e x a m p l e . c o m ~ 1 d o n g l e " ,   }   ]   S t a r t   a   p r o x y ,   s o   t h a t   y o u   c a n   e a s i l y   s e n d   r e q u e s t s   t o   t h e   K u b e r n e t e s   A P I   s e r v e r :   k u b e c t l   p r o x y   I n   a n o t h e r   c o m m a n d   w i n d o w ,   s e n d   t h e   H T T P   P A T C H   r e q u e s t .   R e p l a c e   < y o u r - n o d e - n a m e >   w i t h   t h e   n a m e   o f   y o u r   N o d e :   c u r l   - - h e a d e r   " C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n - p a t c h + j s o n "   \   - - r e q u e s t   P A T C H   \   - - d a t a   ' [ { " o p " :   " r e m o v e " ,   " p a t h " :   " / s t a t u s / c a p a c i t y / e x a m p l e . c o m ~ 1 d o n g l e " } ] '   \   h t t p : / / l o c a l h o s t : 8 0 0 1 / a p i / v 1 / n o d e s / < y o u r - n o d e - n a m e > / s t a t u s   V e r i f y   t h a t   t h e   d o n g l e   a d v e r t i s e m e n t   h a s   b e e n   r e m o v e d :   k u b e c t l   d e s c r i b e   n o d e   < y o u r - n o d e - n a m e >   |   g r e p   d o n g l e   ( y o u   s h o u l d   n o t   s e e   a n y   o u t p u t )


Question: What is For application developers?

Answer: A s s i g n   E x t e n d e d   R e s o u r c e s   t o   a   C o n t a i n e r E x t e n d e d   R e s o u r c e   a l l o c a t i o n   b y   D R A


Question: What is For cluster administrators?

Answer: C o n f i g u r e   M i n i m u m   a n d   M a x i m u m   M e m o r y   C o n s t r a i n t s   f o r   a   N a m e s p a c e C o n f i g u r e   M i n i m u m   a n d   M a x i m u m   C P U   C o n s t r a i n t s   f o r   a   N a m e s p a c e E x t e n d e d   R e s o u r c e   a l l o c a t i o n   b y   D R A


Question: What is kubectl auth whoami?

Answer: kubectl auth whoamiSynopsisExperimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.-h, --helphelp for whoami-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API ser


Question: How does kubectl auth whoami work?

Answer: kubectl auth whoamiSynopsisExperimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.-h, --helphelp for whoami-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API ser


Question: When would you use kubectl auth whoami?

Answer: kubectl auth whoamiSynopsisExperimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.-h, --helphelp for whoami-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API ser


Question: What are the benefits of kubectl auth whoami?

Answer: kubectl auth whoamiSynopsisExperimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.-h, --helphelp for whoami-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API ser


Question: What is Synopsis?

Answer: E x p e r i m e n t a l :   C h e c k   w h o   y o u   a r e   a n d   y o u r   a t t r i b u t e s   ( g r o u p s ,   e x t r a ) .   T h i s   c o m m a n d   i s   h e l p f u l   t o   g e t   y o u r s e l f   a w a r e   o f   t h e   c u r r e n t   u s e r   a t t r i b u t e s ,   e s p e c i a l l y   w h e n   d y n a m i c   a u t h e n t i c a t i o n ,   e . g . ,   t o k e n   w e b h o o k ,   a u t h   p r o x y ,   o r   O I D C   p r o v i d e r ,   i s   e n a b l e d   i n   t h e   K u b e r n e t e s   c l u s t e r .   k u b e c t l   a u t h   w h o a m i


Question: What is Examples?

Answer: #   G e t   y o u r   s u b j e c t   a t t r i b u t e s   k u b e c t l   a u t h   w h o a m i   #   G e t   y o u r   s u b j e c t   a t t r i b u t e s   i n   J S O N   f o r m a t   k u b e c t l   a u t h   w h o a m i   - o   j s o n


Question: What is Options?

Answer: I f   t r u e ,   i g n o r e   a n y   e r r o r s   i n   t e m p l a t e s   w h e n   a   f i e l d   o r   m a p   k e y   i s   m i s s i n g   i n   t h e   t e m p l a t e .   O n l y   a p p l i e s   t o   g o l a n g   a n d   j s o n p a t h   o u t p u t   f o r m a t s .   h e l p   f o r   w h o a m i   O u t p u t   f o r m a t .   O n e   o f :   ( j s o n ,   y a m l ,   n a m e ,   g o - t e m p l a t e ,   g o - t e m p l a t e - f i l e ,   t e m p l a t e ,   t e m p l a t e f i l e ,   j s o n p a t h ,   j s o n p a t h - a s - j s o n ,   j s o n p a t h - f i l e ) .   I f   t r u e ,   k e e p   t h e   m a n a g e d F i e l d s   w h e n   p r i n t i n g   o b j e c t s   i n   J S O N   o r   Y A M L   f o r m a t .   T e m p l a t e   s t r i n g   o r   p a t h   t o   t e m p l a t e   f i l e   t o   u s e   w h e n   - o = g o - t e m p l a t e ,   - o = g o - t e m p l a t e - f i l e .   T h e   t e m p l a t e   f o r m a t   i s   g o l a n g   t e m p l a t e s   [ h t t p : / / g o l a n g . o r g / p k g / t e x t / t e m p l a t e / # p k g - o v e r v i e w ] .


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   a u t h   -   I n s p e c t   a u t h o r i z a t i o n   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Controlling Access to the Kubernetes API?

Answer: Controlling Access to the Kubernetes APIThis page provides an overview of controlling access to the Kubernetes API.Users access the Kubernetes API using kubectl, client libraries, or by making REST requests. Both human users and Kubernetes service accounts can be authorized for API access. When a request reaches the API, it goes through several stages, illustrated in the following diagram:Transport securityBy default, the Kubernetes API server listens on port 6443 on the first non-localhost network interface, protected by TLS. In a typical production Kubernetes cluster, the API serves on port 443. The port can be changed with the --secure-port, and the listening IP address with the --bind-address flag.The API server presents a certificate. This certificate may be signed using a private certificate authority (CA), or based on a public key infrastructure linked to a generally recognized CA. The certificate and corresponding private key can be set by using the --tls-cert-file and --tls-private-key-file flags.If your cluster uses a private certificate authority, you need a copy of that CA certificate configured into your ~/.kube/config on the client, so that you can trust the connection and be confident it was not intercepted.Your client can present a TLS client certificate at this stage.AuthenticationOnce TLS is established, the HTTP request moves to the Authentication step. This is shown as step 1 in the diagram. The cluster creation script or cluster admin configures the API server to run one or more Authenticator modules. Authenticators are described in more detail in Authentication.The input to the authentication step is the entire HTTP request; however, it typically examines the headers and/or client certificate.Authentication modules include client certificates, password, and plain tokens, bootstrap tokens, and JSON Web Tokens (used for service accounts).Multiple authentication modules can be specified, in which case each one is tried in sequence, until one of them succeeds.If the request cannot be authenticated, it is rejected with HTTP status code 401. Otherwise, the user is authenticated as a specific username, and the user name is available to subsequent steps to use in their decisions. Some authenticators also provide the group memberships of the user, while other authenticators do not.While Kubernetes uses usernames for access control decisions and in request logging, it does not have a User object nor does it store usernames or other information about users in its API.AuthorizationAfter the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step 2 in the diagram.A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.For example, if Bob has the policy below, then he can read pods only in the namespace proje


Question: How does Controlling Access to the Kubernetes API work?

Answer: Controlling Access to the Kubernetes APIThis page provides an overview of controlling access to the Kubernetes API.Users access the Kubernetes API using kubectl, client libraries, or by making REST requests. Both human users and Kubernetes service accounts can be authorized for API access. When a request reaches the API, it goes through several stages, illustrated in the following diagram:Transport securityBy default, the Kubernetes API server listens on port 6443 on the first non-localhost network interface, protected by TLS. In a typical production Kubernetes cluster, the API serves on port 443. The port can be changed with the --secure-port, and the listening IP address with the --bind-address flag.The API server presents a certificate. This certificate may be signed using a private certificate authority (CA), or based on a public key infrastructure linked to a generally recognized CA. The certificate and corresponding private key can be set by using the --tls-cert-file and --tls-private-key-file flags.If your cluster uses a private certificate authority, you need a copy of that CA certificate configured into your ~/.kube/config on the client, so that you can trust the connection and be confident it was not intercepted.Your client can present a TLS client certificate at this stage.AuthenticationOnce TLS is established, the HTTP request moves to the Authentication step. This is shown as step 1 in the diagram. The cluster creation script or cluster admin configures the API server to run one or more Authenticator modules. Authenticators are described in more detail in Authentication.The input to the authentication step is the entire HTTP request; however, it typically examines the headers and/or client certificate.Authentication modules include client certificates, password, and plain tokens, bootstrap tokens, and JSON Web Tokens (used for service accounts).Multiple authentication modules can be specified, in which case each one is tried in sequence, until one of them succeeds.If the request cannot be authenticated, it is rejected with HTTP status code 401. Otherwise, the user is authenticated as a specific username, and the user name is available to subsequent steps to use in their decisions. Some authenticators also provide the group memberships of the user, while other authenticators do not.While Kubernetes uses usernames for access control decisions and in request logging, it does not have a User object nor does it store usernames or other information about users in its API.AuthorizationAfter the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step 2 in the diagram.A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.For example, if Bob has the policy below, then he can read pods only in the namespace proje


Question: When would you use Controlling Access to the Kubernetes API?

Answer: Controlling Access to the Kubernetes APIThis page provides an overview of controlling access to the Kubernetes API.Users access the Kubernetes API using kubectl, client libraries, or by making REST requests. Both human users and Kubernetes service accounts can be authorized for API access. When a request reaches the API, it goes through several stages, illustrated in the following diagram:Transport securityBy default, the Kubernetes API server listens on port 6443 on the first non-localhost network interface, protected by TLS. In a typical production Kubernetes cluster, the API serves on port 443. The port can be changed with the --secure-port, and the listening IP address with the --bind-address flag.The API server presents a certificate. This certificate may be signed using a private certificate authority (CA), or based on a public key infrastructure linked to a generally recognized CA. The certificate and corresponding private key can be set by using the --tls-cert-file and --tls-private-key-file flags.If your cluster uses a private certificate authority, you need a copy of that CA certificate configured into your ~/.kube/config on the client, so that you can trust the connection and be confident it was not intercepted.Your client can present a TLS client certificate at this stage.AuthenticationOnce TLS is established, the HTTP request moves to the Authentication step. This is shown as step 1 in the diagram. The cluster creation script or cluster admin configures the API server to run one or more Authenticator modules. Authenticators are described in more detail in Authentication.The input to the authentication step is the entire HTTP request; however, it typically examines the headers and/or client certificate.Authentication modules include client certificates, password, and plain tokens, bootstrap tokens, and JSON Web Tokens (used for service accounts).Multiple authentication modules can be specified, in which case each one is tried in sequence, until one of them succeeds.If the request cannot be authenticated, it is rejected with HTTP status code 401. Otherwise, the user is authenticated as a specific username, and the user name is available to subsequent steps to use in their decisions. Some authenticators also provide the group memberships of the user, while other authenticators do not.While Kubernetes uses usernames for access control decisions and in request logging, it does not have a User object nor does it store usernames or other information about users in its API.AuthorizationAfter the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step 2 in the diagram.A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.For example, if Bob has the policy below, then he can read pods only in the namespace proje


Question: What are the benefits of Controlling Access to the Kubernetes API?

Answer: Controlling Access to the Kubernetes APIThis page provides an overview of controlling access to the Kubernetes API.Users access the Kubernetes API using kubectl, client libraries, or by making REST requests. Both human users and Kubernetes service accounts can be authorized for API access. When a request reaches the API, it goes through several stages, illustrated in the following diagram:Transport securityBy default, the Kubernetes API server listens on port 6443 on the first non-localhost network interface, protected by TLS. In a typical production Kubernetes cluster, the API serves on port 443. The port can be changed with the --secure-port, and the listening IP address with the --bind-address flag.The API server presents a certificate. This certificate may be signed using a private certificate authority (CA), or based on a public key infrastructure linked to a generally recognized CA. The certificate and corresponding private key can be set by using the --tls-cert-file and --tls-private-key-file flags.If your cluster uses a private certificate authority, you need a copy of that CA certificate configured into your ~/.kube/config on the client, so that you can trust the connection and be confident it was not intercepted.Your client can present a TLS client certificate at this stage.AuthenticationOnce TLS is established, the HTTP request moves to the Authentication step. This is shown as step 1 in the diagram. The cluster creation script or cluster admin configures the API server to run one or more Authenticator modules. Authenticators are described in more detail in Authentication.The input to the authentication step is the entire HTTP request; however, it typically examines the headers and/or client certificate.Authentication modules include client certificates, password, and plain tokens, bootstrap tokens, and JSON Web Tokens (used for service accounts).Multiple authentication modules can be specified, in which case each one is tried in sequence, until one of them succeeds.If the request cannot be authenticated, it is rejected with HTTP status code 401. Otherwise, the user is authenticated as a specific username, and the user name is available to subsequent steps to use in their decisions. Some authenticators also provide the group memberships of the user, while other authenticators do not.While Kubernetes uses usernames for access control decisions and in request logging, it does not have a User object nor does it store usernames or other information about users in its API.AuthorizationAfter the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step 2 in the diagram.A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.For example, if Bob has the policy below, then he can read pods only in the namespace proje


Question: What is Controlling Access to the Kubernetes API?

Answer: T h i s   p a g e   p r o v i d e s   a n   o v e r v i e w   o f   c o n t r o l l i n g   a c c e s s   t o   t h e   K u b e r n e t e s   A P I .   U s e r s   a c c e s s   t h e   K u b e r n e t e s   A P I   u s i n g   k u b e c t l ,   c l i e n t   l i b r a r i e s ,   o r   b y   m a k i n g   R E S T   r e q u e s t s .   B o t h   h u m a n   u s e r s   a n d   K u b e r n e t e s   s e r v i c e   a c c o u n t s   c a n   b e   a u t h o r i z e d   f o r   A P I   a c c e s s .   W h e n   a   r e q u e s t   r e a c h e s   t h e   A P I ,   i t   g o e s   t h r o u g h   s e v e r a l   s t a g e s ,   i l l u s t r a t e d   i n   t h e   f o l l o w i n g   d i a g r a m :


Question: What is Transport security?

Answer: B y   d e f a u l t ,   t h e   K u b e r n e t e s   A P I   s e r v e r   l i s t e n s   o n   p o r t   6 4 4 3   o n   t h e   f i r s t   n o n - l o c a l h o s t   n e t w o r k   i n t e r f a c e ,   p r o t e c t e d   b y   T L S .   I n   a   t y p i c a l   p r o d u c t i o n   K u b e r n e t e s   c l u s t e r ,   t h e   A P I   s e r v e s   o n   p o r t   4 4 3 .   T h e   p o r t   c a n   b e   c h a n g e d   w i t h   t h e   - - s e c u r e - p o r t ,   a n d   t h e   l i s t e n i n g   I P   a d d r e s s   w i t h   t h e   - - b i n d - a d d r e s s   f l a g .   T h e   A P I   s e r v e r   p r e s e n t s   a   c e r t i f i c a t e .   T h i s   c e r t i f i c a t e   m a y   b e   s i g n e d   u s i n g   a   p r i v a t e   c e r t i f i c a t e   a u t h o r i t y   ( C A ) ,   o r   b a s e d   o n   a   p u b l i c   k e y   i n f r a s t r u c t u r e   l i n k e d   t o   a   g e n e r a l l y   r e c o g n i z e d   C A .   T h e   c e r t i f i c a t e   a n d   c o r r e s p o n d i n g   p r i v a t e   k e y   c a n   b e   s e t   b y   u s i n g   t h e   - - t l s - c e r t - f i l e   a n d   - - t l s - p r i v a t e - k e y - f i l e   f l a g s .   I f   y o u r   c l u s t e r   u s e s   a   p r i v a t e   c e r t i f i c a t e   a u t h o r i t y ,   y o u   n e e d   a   c o p y   o f   t h a t   C A   c e r t i f i c a t e   c o n f i g u r e d   i n t o   y o u r   ~ / . k u b e / c o n f i g   o n   t h e   c l i e n t ,   s o   t h a t   y o u   c a n   t r u s t   t h e   c o n n e c t i o n   a n d   b e   c o n f i d e n t   i t   w a s   n o t   i n t e r c e p t e d .   Y o u r   c l i e n t   c a n   p r e s e n t   a   T L S   c l i e n t   c e r t i f i c a t e   a t   t h i s   s t a g e .


Question: What is Authentication?

Answer: O n c e   T L S   i s   e s t a b l i s h e d ,   t h e   H T T P   r e q u e s t   m o v e s   t o   t h e   A u t h e n t i c a t i o n   s t e p .   T h i s   i s   s h o w n   a s   s t e p   1   i n   t h e   d i a g r a m .   T h e   c l u s t e r   c r e a t i o n   s c r i p t   o r   c l u s t e r   a d m i n   c o n f i g u r e s   t h e   A P I   s e r v e r   t o   r u n   o n e   o r   m o r e   A u t h e n t i c a t o r   m o d u l e s .   A u t h e n t i c a t o r s   a r e   d e s c r i b e d   i n   m o r e   d e t a i l   i n   A u t h e n t i c a t i o n .   T h e   i n p u t   t o   t h e   a u t h e n t i c a t i o n   s t e p   i s   t h e   e n t i r e   H T T P   r e q u e s t ;   h o w e v e r ,   i t   t y p i c a l l y   e x a m i n e s   t h e   h e a d e r s   a n d / o r   c l i e n t   c e r t i f i c a t e .   A u t h e n t i c a t i o n   m o d u l e s   i n c l u d e   c l i e n t   c e r t i f i c a t e s ,   p a s s w o r d ,   a n d   p l a i n   t o k e n s ,   b o o t s t r a p   t o k e n s ,   a n d   J S O N   W e b   T o k e n s   ( u s e d   f o r   s e r v i c e   a c c o u n t s ) .   M u l t i p l e   a u t h e n t i c a t i o n   m o d u l e s   c a n   b e   s p e c i f i e d ,   i n   w h i c h   c a s e   e a c h   o n e   i s   t r i e d   i n   s e q u e n c e ,   u n t i l   o n e   o f   t h e m   s u c c e e d s .   I f   t h e   r e q u e s t   c a n n o t   b e   a u t h e n t i c a t e d ,   i t   i s   r e j e c t e d   w i t h   H T T P   s t a t u s   c o d e   4 0 1 .   O t h e r w i s e ,   t h e   u s e r   i s   a u t h e n t i c a t e d   a s   a   s p e c i f i c   u s e r n a m e ,   a n d   t h e   u s e r   n a m e   i s   a v a i l a b l e   t o   s u b s e q u e n t   s t e p s   t o   u s e   i n   t h e i r   d e c i s i o n s .   S o m e   a u t h e n t i c a t o r s   a l s o   p r o v i d e   t h e   g r o u p   m e m b e r s h i p s   o f   t h e   u s e r ,   w h i l e   o t h e r   a u


Question: What is Authorization?

Answer: A f t e r   t h e   r e q u e s t   i s   a u t h e n t i c a t e d   a s   c o m i n g   f r o m   a   s p e c i f i c   u s e r ,   t h e   r e q u e s t   m u s t   b e   a u t h o r i z e d .   T h i s   i s   s h o w n   a s   s t e p   2   i n   t h e   d i a g r a m .   A   r e q u e s t   m u s t   i n c l u d e   t h e   u s e r n a m e   o f   t h e   r e q u e s t e r ,   t h e   r e q u e s t e d   a c t i o n ,   a n d   t h e   o b j e c t   a f f e c t e d   b y   t h e   a c t i o n .   T h e   r e q u e s t   i s   a u t h o r i z e d   i f   a n   e x i s t i n g   p o l i c y   d e c l a r e s   t h a t   t h e   u s e r   h a s   p e r m i s s i o n s   t o   c o m p l e t e   t h e   r e q u e s t e d   a c t i o n .   F o r   e x a m p l e ,   i f   B o b   h a s   t h e   p o l i c y   b e l o w ,   t h e n   h e   c a n   r e a d   p o d s   o n l y   i n   t h e   n a m e s p a c e   p r o j e c t C a r i b o u :   {   " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   {   " u s e r " :   " b o b " ,   " n a m e s p a c e " :   " p r o j e c t C a r i b o u " ,   " r e s o u r c e " :   " p o d s " ,   " r e a d o n l y " :   t r u e   }   }   I f   B o b   m a k e s   t h e   f o l l o w i n g   r e q u e s t ,   t h e   r e q u e s t   i s   a u t h o r i z e d   b e c a u s e   h e   i s   a l l o w e d   t o   r e a d   o b j e c t s   i n   t h e   p r o j e c t C a r i b o u   n a m e s p a c e :   {   " a p i V e r s i o n " :   " a u t h o r i z a t i o n . k 8 s . i o / v 1 b e t a 1 " ,   " k i n d " :   " S u b j e c t A c c e s s R e v i e w " ,   " s p e c " :   {   " r e s o u r c e A t t r i b u t e s " :   {   " n a m e s p a c e " :   " p r o j e c t C a r i b o u " ,   " v e r b " :   " g e t " ,   " g r o u p " :   " u n i c o r n . e x a m p l e . o r g " ,   " r e s o u r c e " :   " p o d s "   }   }   }


Question: What is Admission control?

Answer: A d m i s s i o n   C o n t r o l   m o d u l e s   a r e   s o f t w a r e   m o d u l e s   t h a t   c a n   m o d i f y   o r   r e j e c t   r e q u e s t s .   I n   a d d i t i o n   t o   t h e   a t t r i b u t e s   a v a i l a b l e   t o   A u t h o r i z a t i o n   m o d u l e s ,   A d m i s s i o n   C o n t r o l   m o d u l e s   c a n   a c c e s s   t h e   c o n t e n t s   o f   t h e   o b j e c t   t h a t   i s   b e i n g   c r e a t e d   o r   m o d i f i e d .   A d m i s s i o n   c o n t r o l l e r s   a c t   o n   r e q u e s t s   t h a t   c r e a t e ,   m o d i f y ,   d e l e t e ,   o r   c o n n e c t   t o   ( p r o x y )   a n   o b j e c t .   A d m i s s i o n   c o n t r o l l e r s   d o   n o t   a c t   o n   r e q u e s t s   t h a t   m e r e l y   r e a d   o b j e c t s .   W h e n   m u l t i p l e   a d m i s s i o n   c o n t r o l l e r s   a r e   c o n f i g u r e d ,   t h e y   a r e   c a l l e d   i n   o r d e r .   T h i s   i s   s h o w n   a s   s t e p   3   i n   t h e   d i a g r a m .   U n l i k e   A u t h e n t i c a t i o n   a n d   A u t h o r i z a t i o n   m o d u l e s ,   i f   a n y   a d m i s s i o n   c o n t r o l l e r   m o d u l e   r e j e c t s ,   t h e n   t h e   r e q u e s t   i s   i m m e d i a t e l y   r e j e c t e d .   I n   a d d i t i o n   t o   r e j e c t i n g   o b j e c t s ,   a d m i s s i o n   c o n t r o l l e r s   c a n   a l s o   s e t   c o m p l e x   d e f a u l t s   f o r   f i e l d s .   T h e   a v a i l a b l e   A d m i s s i o n   C o n t r o l   m o d u l e s   a r e   d e s c r i b e d   i n   A d m i s s i o n   C o n t r o l l e r s .   O n c e   a   r e q u e s t   p a s s e s   a l l   a d m i s s i o n   c o n t r o l l e r s ,   i t   i s   v a l i d a t e d   u s i n g   t h e   v a l i d a t i o n   r o u t i n e s   f o r   t h e   c o r r e s p o n d i n g   A P I   o b j e c t ,   a n d   t h e n   w r i t t e n   t o   t


Question: What is Auditing?

Answer: K u b e r n e t e s   a u d i t i n g   p r o v i d e s   a   s e c u r i t y - r e l e v a n t ,   c h r o n o l o g i c a l   s e t   o f   r e c o r d s   d o c u m e n t i n g   t h e   s e q u e n c e   o f   a c t i o n s   i n   a   c l u s t e r .   T h e   c l u s t e r   a u d i t s   t h e   a c t i v i t i e s   g e n e r a t e d   b y   u s e r s ,   b y   a p p l i c a t i o n s   t h a t   u s e   t h e   K u b e r n e t e s   A P I ,   a n d   b y   t h e   c o n t r o l   p l a n e   i t s e l f .   F o r   m o r e   i n f o r m a t i o n ,   s e e   A u d i t i n g .


Question: What is What's next?

Answer: R e a d   m o r e   d o c u m e n t a t i o n   o n   a u t h e n t i c a t i o n ,   a u t h o r i z a t i o n   a n d   A P I   a c c e s s   c o n t r o l :   A u t h e n t i c a t i n g A u t h e n t i c a t i n g   w i t h   B o o t s t r a p   T o k e n s A d m i s s i o n   C o n t r o l l e r s D y n a m i c   A d m i s s i o n   C o n t r o l A u t h o r i z a t i o n R o l e   B a s e d   A c c e s s   C o n t r o l A t t r i b u t e   B a s e d   A c c e s s   C o n t r o l N o d e   A u t h o r i z a t i o n W e b h o o k   A u t h o r i z a t i o n C e r t i f i c a t e   S i g n i n g   R e q u e s t s i n c l u d i n g   C S R   a p p r o v a l   a n d   c e r t i f i c a t e   s i g n i n g S e r v i c e   a c c o u n t s D e v e l o p e r   g u i d e A d m i n i s t r a t i o n   A u t h e n t i c a t i n g   w i t h   B o o t s t r a p   T o k e n s   D y n a m i c   A d m i s s i o n   C o n t r o l   R o l e   B a s e d   A c c e s s   C o n t r o l A t t r i b u t e   B a s e d   A c c e s s   C o n t r o l N o d e   A u t h o r i z a t i o n W e b h o o k   A u t h o r i z a t i o n   i n c l u d i n g   C S R   a p p r o v a l   a n d   c e r t i f i c a t e   s i g n i n g   D e v e l o p e r   g u i d e A d m i n i s t r a t i o n   Y o u   c a n   l e a r n   a b o u t :   h o w   P o d s   c a n   u s e   S e c r e t s   t o   o b t a i n   A P I   c r e d e n t i a l s .


Question: What is Use Cilium for NetworkPolicy?

Answer: Use Cilium for NetworkPolicyThis page shows how to use Cilium for NetworkPolicy.For background on Cilium, read the Introduction to Cilium.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Deploying Cilium on Minikube for Basic TestingTo get familiar with Cilium easily you can follow the Cilium Kubernetes Getting Started Guide to perform a basic DaemonSet installation of Cilium in minikube.To start minikube, minimal version required is >= v1.5.2, run the with the following arguments:minikube version minikube version: v1.5.2 minikube start --network-plugin=cni For minikube you can install Cilium using its CLI tool. To do so, first download the latest version of the CLI with the following command:curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz Then extract the downloaded file to your /usr/local/bin directory with the following command:sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin rm cilium-linux-amd64.tar.gz After running the above commands, you can now install Cilium with the following command:cilium install Cilium will then automatically detect the cluster configuration and create and install the appropriate components for a successful installation. The components are:Certificate Authority (CA) in Secret cilium-ca and certificates for Hubble (Cilium's observability layer).Service accounts.Cluster roles.ConfigMap.Agent DaemonSet and an Operator Deployment.After the installation, you can view the overall status of the Cilium deployment with the cilium status command. See the expected output of the status command here.The remainder of the Getting Started Guide explains how to enforce both L3/L4 (i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security policies using an example application.Deploying Cilium for Production UseFor detailed instructions around deploying Cilium for production, see: Cilium Kubernetes Installation Guide This documentation includes detailed requirements, instructions and example production DaemonSet files.Understanding Cilium componentsDeploying a cluster with Cilium adds Pods to the kube-system namespace. To see this list of Pods run:kubectl get pods --namespace=kube-system -l k8s-app=cilium You'll see a list of Pods similar to this:NAME READY STATUS RESTARTS AGE cilium-kkdhz 1/1 Running 0 3m23s ... A cilium Pod runs on each node in your cluster and enforces network policy on the traffic to/from Pods on that node using Linux BPF.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try ou


Question: How does Use Cilium for NetworkPolicy work?

Answer: Use Cilium for NetworkPolicyThis page shows how to use Cilium for NetworkPolicy.For background on Cilium, read the Introduction to Cilium.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Deploying Cilium on Minikube for Basic TestingTo get familiar with Cilium easily you can follow the Cilium Kubernetes Getting Started Guide to perform a basic DaemonSet installation of Cilium in minikube.To start minikube, minimal version required is >= v1.5.2, run the with the following arguments:minikube version minikube version: v1.5.2 minikube start --network-plugin=cni For minikube you can install Cilium using its CLI tool. To do so, first download the latest version of the CLI with the following command:curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz Then extract the downloaded file to your /usr/local/bin directory with the following command:sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin rm cilium-linux-amd64.tar.gz After running the above commands, you can now install Cilium with the following command:cilium install Cilium will then automatically detect the cluster configuration and create and install the appropriate components for a successful installation. The components are:Certificate Authority (CA) in Secret cilium-ca and certificates for Hubble (Cilium's observability layer).Service accounts.Cluster roles.ConfigMap.Agent DaemonSet and an Operator Deployment.After the installation, you can view the overall status of the Cilium deployment with the cilium status command. See the expected output of the status command here.The remainder of the Getting Started Guide explains how to enforce both L3/L4 (i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security policies using an example application.Deploying Cilium for Production UseFor detailed instructions around deploying Cilium for production, see: Cilium Kubernetes Installation Guide This documentation includes detailed requirements, instructions and example production DaemonSet files.Understanding Cilium componentsDeploying a cluster with Cilium adds Pods to the kube-system namespace. To see this list of Pods run:kubectl get pods --namespace=kube-system -l k8s-app=cilium You'll see a list of Pods similar to this:NAME READY STATUS RESTARTS AGE cilium-kkdhz 1/1 Running 0 3m23s ... A cilium Pod runs on each node in your cluster and enforces network policy on the traffic to/from Pods on that node using Linux BPF.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try ou


Question: When would you use Use Cilium for NetworkPolicy?

Answer: Use Cilium for NetworkPolicyThis page shows how to use Cilium for NetworkPolicy.For background on Cilium, read the Introduction to Cilium.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Deploying Cilium on Minikube for Basic TestingTo get familiar with Cilium easily you can follow the Cilium Kubernetes Getting Started Guide to perform a basic DaemonSet installation of Cilium in minikube.To start minikube, minimal version required is >= v1.5.2, run the with the following arguments:minikube version minikube version: v1.5.2 minikube start --network-plugin=cni For minikube you can install Cilium using its CLI tool. To do so, first download the latest version of the CLI with the following command:curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz Then extract the downloaded file to your /usr/local/bin directory with the following command:sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin rm cilium-linux-amd64.tar.gz After running the above commands, you can now install Cilium with the following command:cilium install Cilium will then automatically detect the cluster configuration and create and install the appropriate components for a successful installation. The components are:Certificate Authority (CA) in Secret cilium-ca and certificates for Hubble (Cilium's observability layer).Service accounts.Cluster roles.ConfigMap.Agent DaemonSet and an Operator Deployment.After the installation, you can view the overall status of the Cilium deployment with the cilium status command. See the expected output of the status command here.The remainder of the Getting Started Guide explains how to enforce both L3/L4 (i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security policies using an example application.Deploying Cilium for Production UseFor detailed instructions around deploying Cilium for production, see: Cilium Kubernetes Installation Guide This documentation includes detailed requirements, instructions and example production DaemonSet files.Understanding Cilium componentsDeploying a cluster with Cilium adds Pods to the kube-system namespace. To see this list of Pods run:kubectl get pods --namespace=kube-system -l k8s-app=cilium You'll see a list of Pods similar to this:NAME READY STATUS RESTARTS AGE cilium-kkdhz 1/1 Running 0 3m23s ... A cilium Pod runs on each node in your cluster and enforces network policy on the traffic to/from Pods on that node using Linux BPF.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try ou


Question: What are the benefits of Use Cilium for NetworkPolicy?

Answer: Use Cilium for NetworkPolicyThis page shows how to use Cilium for NetworkPolicy.For background on Cilium, read the Introduction to Cilium.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Deploying Cilium on Minikube for Basic TestingTo get familiar with Cilium easily you can follow the Cilium Kubernetes Getting Started Guide to perform a basic DaemonSet installation of Cilium in minikube.To start minikube, minimal version required is >= v1.5.2, run the with the following arguments:minikube version minikube version: v1.5.2 minikube start --network-plugin=cni For minikube you can install Cilium using its CLI tool. To do so, first download the latest version of the CLI with the following command:curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz Then extract the downloaded file to your /usr/local/bin directory with the following command:sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin rm cilium-linux-amd64.tar.gz After running the above commands, you can now install Cilium with the following command:cilium install Cilium will then automatically detect the cluster configuration and create and install the appropriate components for a successful installation. The components are:Certificate Authority (CA) in Secret cilium-ca and certificates for Hubble (Cilium's observability layer).Service accounts.Cluster roles.ConfigMap.Agent DaemonSet and an Operator Deployment.After the installation, you can view the overall status of the Cilium deployment with the cilium status command. See the expected output of the status command here.The remainder of the Getting Started Guide explains how to enforce both L3/L4 (i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security policies using an example application.Deploying Cilium for Production UseFor detailed instructions around deploying Cilium for production, see: Cilium Kubernetes Installation Guide This documentation includes detailed requirements, instructions and example production DaemonSet files.Understanding Cilium componentsDeploying a cluster with Cilium adds Pods to the kube-system namespace. To see this list of Pods run:kubectl get pods --namespace=kube-system -l k8s-app=cilium You'll see a list of Pods similar to this:NAME READY STATUS RESTARTS AGE cilium-kkdhz 1/1 Running 0 3m23s ... A cilium Pod runs on each node in your cluster and enforces network policy on the traffic to/from Pods on that node using Linux BPF.What's nextOnce your cluster is running, you can follow the Declare Network Policy to try ou


Question: What is Use Cilium for NetworkPolicy?

Answer: T h i s   p a g e   s h o w s   h o w   t o   u s e   C i l i u m   f o r   N e t w o r k P o l i c y .   F o r   b a c k g r o u n d   o n   C i l i u m ,   r e a d   t h e   I n t r o d u c t i o n   t o   C i l i u m .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Deploying Cilium on Minikube for Basic Testing?

Answer: T o   g e t   f a m i l i a r   w i t h   C i l i u m   e a s i l y   y o u   c a n   f o l l o w   t h e   C i l i u m   K u b e r n e t e s   G e t t i n g   S t a r t e d   G u i d e   t o   p e r f o r m   a   b a s i c   D a e m o n S e t   i n s t a l l a t i o n   o f   C i l i u m   i n   m i n i k u b e .   T o   s t a r t   m i n i k u b e ,   m i n i m a l   v e r s i o n   r e q u i r e d   i s   > =   v 1 . 5 . 2 ,   r u n   t h e   w i t h   t h e   f o l l o w i n g   a r g u m e n t s :   m i n i k u b e   v e r s i o n   m i n i k u b e   v e r s i o n :   v 1 . 5 . 2   m i n i k u b e   s t a r t   - - n e t w o r k - p l u g i n = c n i   F o r   m i n i k u b e   y o u   c a n   i n s t a l l   C i l i u m   u s i n g   i t s   C L I   t o o l .   T o   d o   s o ,   f i r s t   d o w n l o a d   t h e   l a t e s t   v e r s i o n   o f   t h e   C L I   w i t h   t h e   f o l l o w i n g   c o m m a n d :   c u r l   - L O   h t t p s : / / g i t h u b . c o m / c i l i u m / c i l i u m - c l i / r e l e a s e s / l a t e s t / d o w n l o a d / c i l i u m - l i n u x - a m d 6 4 . t a r . g z   T h e n   e x t r a c t   t h e   d o w n l o a d e d   f i l e   t o   y o u r   / u s r / l o c a l / b i n   d i r e c t o r y   w i t h   t h e   f o l l o w i n g   c o m m a n d :   s u d o   t a r   x z v f C   c i l i u m - l i n u x - a m d 6 4 . t a r . g z   / u s r / l o c a l / b i n   r m   c i l i u m - l i n u x - a m d 6 4 . t a r . g z   A f t e r   r u n n i n g   t h e   a b o v e   c o m m a n d s ,   y o u   c a n   n o w   i n s t a l l   C i l i u m   w i t h   t h e   f o l l o w i n g   c o m m a n d :   c i l i u m   i n s t a l l   C i l i u m   w i l l   t h e n   a u t o m a t i c a l l y   d e t e c t   t h e   c l u s t e r   c o n f i g u r a t i o n   a n d   c r e a t e   a n d   i n s t a l l   t h e   a p p r o p r i a t e   c o m p o n e n t s   f o r   a   s u c c e s s f u l   i n s t a l l a t i o n .   T h e


Question: What is Deploying Cilium for Production Use?

Answer: F o r   d e t a i l e d   i n s t r u c t i o n s   a r o u n d   d e p l o y i n g   C i l i u m   f o r   p r o d u c t i o n ,   s e e :   C i l i u m   K u b e r n e t e s   I n s t a l l a t i o n   G u i d e   T h i s   d o c u m e n t a t i o n   i n c l u d e s   d e t a i l e d   r e q u i r e m e n t s ,   i n s t r u c t i o n s   a n d   e x a m p l e   p r o d u c t i o n   D a e m o n S e t   f i l e s .


Question: What is Understanding Cilium components?

Answer: D e p l o y i n g   a   c l u s t e r   w i t h   C i l i u m   a d d s   P o d s   t o   t h e   k u b e - s y s t e m   n a m e s p a c e .   T o   s e e   t h i s   l i s t   o f   P o d s   r u n :   k u b e c t l   g e t   p o d s   - - n a m e s p a c e = k u b e - s y s t e m   - l   k 8 s - a p p = c i l i u m   Y o u ' l l   s e e   a   l i s t   o f   P o d s   s i m i l a r   t o   t h i s :   N A M E   R E A D Y   S T A T U S   R E S T A R T S   A G E   c i l i u m - k k d h z   1 / 1   R u n n i n g   0   3 m 2 3 s   . . .   A   c i l i u m   P o d   r u n s   o n   e a c h   n o d e   i n   y o u r   c l u s t e r   a n d   e n f o r c e s   n e t w o r k   p o l i c y   o n   t h e   t r a f f i c   t o / f r o m   P o d s   o n   t h a t   n o d e   u s i n g   L i n u x   B P F .


Question: What is What's next?

Answer: O n c e   y o u r   c l u s t e r   i s   r u n n i n g ,   y o u   c a n   f o l l o w   t h e   D e c l a r e   N e t w o r k   P o l i c y   t o   t r y   o u t   K u b e r n e t e s   N e t w o r k P o l i c y   w i t h   C i l i u m .   H a v e   f u n ,   a n d   i f   y o u   h a v e   q u e s t i o n s ,   c o n t a c t   u s   u s i n g   t h e   C i l i u m   S l a c k   C h a n n e l .


Question: What is kubectl rollout status?

Answer: kubectl rollout statusSynopsisShow the status of the rollout.By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.kubectl rollout status (TYPE NAME | TYPE/NAME) [flags] Examples # Watch the rollout status of a deployment kubectl rollout status deployment/nginx Options-f, --filename stringsFilename, directory, or URL to files identifying the resource to get from a server.-h, --helphelp for status-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.--revision intPin to a specific revision for showing its status. Defaults to 0 (last revision).-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--timeout durationThe length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).-w, --watch Default: trueWatch the status of the rollout until it's done.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none


Question: How does kubectl rollout status work?

Answer: kubectl rollout statusSynopsisShow the status of the rollout.By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.kubectl rollout status (TYPE NAME | TYPE/NAME) [flags] Examples # Watch the rollout status of a deployment kubectl rollout status deployment/nginx Options-f, --filename stringsFilename, directory, or URL to files identifying the resource to get from a server.-h, --helphelp for status-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.--revision intPin to a specific revision for showing its status. Defaults to 0 (last revision).-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--timeout durationThe length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).-w, --watch Default: trueWatch the status of the rollout until it's done.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none


Question: When would you use kubectl rollout status?

Answer: kubectl rollout statusSynopsisShow the status of the rollout.By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.kubectl rollout status (TYPE NAME | TYPE/NAME) [flags] Examples # Watch the rollout status of a deployment kubectl rollout status deployment/nginx Options-f, --filename stringsFilename, directory, or URL to files identifying the resource to get from a server.-h, --helphelp for status-k, --kustomize stringProcess the kustomization directory. This flag can't be used together with -f or -R.-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.--revision intPin to a specific revision for showing its status. Defaults to 0 (last revision).-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--timeout durationThe length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).-w, --watch Default: trueWatch the status of the rollout until it's done.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none