Question: How does Namespace work?

Answer: NamespaceNamespace provides a scope for Names.apiVersion: v1import "k8s.io/api/core/v1"NamespaceNamespace provides a scope for Names. Use of multiple namespaces is optional.apiVersion: v1kind: Namespacemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (NamespaceSpec)Spec defines the behavior of the Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (NamespaceStatus)Status describes the current status of a Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusNamespaceSpecNamespaceSpec describes the attributes on a Namespace.finalizers ([]string)Atomic: will be replaced during a mergeFinalizers is an opaque list of values that must be empty to permanently remove object from storage. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceStatusNamespaceStatus is information about the current status of a Namespace.conditions ([]NamespaceCondition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeRepresents the latest available observations of a namespace's current state.NamespaceCondition contains details about state of namespace.conditions.status (string), requiredStatus of the condition, one of True, False, Unknown.conditions.type (string), requiredType of namespace controller condition.conditions.lastTransitionTime (Time)Last time the condition transitioned from one status to another.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string)Human-readable message indicating details about last transition.conditions.reason (string)Unique, one-word, CamelCase reason for the condition's last transition.phase (string)Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceListNamespaceList is a list of Namespaces.apiVersion: v1kind: NamespaceListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Namespace), requiredItems is the list of Namespace objects in the list. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/Operationsget read the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}Parametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedget read status of the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}/statusParametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedlist list or watch obje


Question: When would you use Namespace?

Answer: NamespaceNamespace provides a scope for Names.apiVersion: v1import "k8s.io/api/core/v1"NamespaceNamespace provides a scope for Names. Use of multiple namespaces is optional.apiVersion: v1kind: Namespacemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (NamespaceSpec)Spec defines the behavior of the Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (NamespaceStatus)Status describes the current status of a Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusNamespaceSpecNamespaceSpec describes the attributes on a Namespace.finalizers ([]string)Atomic: will be replaced during a mergeFinalizers is an opaque list of values that must be empty to permanently remove object from storage. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceStatusNamespaceStatus is information about the current status of a Namespace.conditions ([]NamespaceCondition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeRepresents the latest available observations of a namespace's current state.NamespaceCondition contains details about state of namespace.conditions.status (string), requiredStatus of the condition, one of True, False, Unknown.conditions.type (string), requiredType of namespace controller condition.conditions.lastTransitionTime (Time)Last time the condition transitioned from one status to another.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string)Human-readable message indicating details about last transition.conditions.reason (string)Unique, one-word, CamelCase reason for the condition's last transition.phase (string)Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceListNamespaceList is a list of Namespaces.apiVersion: v1kind: NamespaceListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Namespace), requiredItems is the list of Namespace objects in the list. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/Operationsget read the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}Parametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedget read status of the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}/statusParametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedlist list or watch obje


Question: What are the benefits of Namespace?

Answer: NamespaceNamespace provides a scope for Names.apiVersion: v1import "k8s.io/api/core/v1"NamespaceNamespace provides a scope for Names. Use of multiple namespaces is optional.apiVersion: v1kind: Namespacemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (NamespaceSpec)Spec defines the behavior of the Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (NamespaceStatus)Status describes the current status of a Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusNamespaceSpecNamespaceSpec describes the attributes on a Namespace.finalizers ([]string)Atomic: will be replaced during a mergeFinalizers is an opaque list of values that must be empty to permanently remove object from storage. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceStatusNamespaceStatus is information about the current status of a Namespace.conditions ([]NamespaceCondition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeRepresents the latest available observations of a namespace's current state.NamespaceCondition contains details about state of namespace.conditions.status (string), requiredStatus of the condition, one of True, False, Unknown.conditions.type (string), requiredType of namespace controller condition.conditions.lastTransitionTime (Time)Last time the condition transitioned from one status to another.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string)Human-readable message indicating details about last transition.conditions.reason (string)Unique, one-word, CamelCase reason for the condition's last transition.phase (string)Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/NamespaceListNamespaceList is a list of Namespaces.apiVersion: v1kind: NamespaceListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Namespace), requiredItems is the list of Namespace objects in the list. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/Operationsget read the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}Parametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedget read status of the specified NamespaceHTTP RequestGET /api/v1/namespaces/{name}/statusParametersname (in path): string, requiredname of the Namespacepretty (in query): stringprettyResponse200 (Namespace): OK401: Unauthorizedlist list or watch obje


Question: What is Namespace?

Answer: a p i V e r s i o n :   v 1   i m p o r t   " k 8 s . i o / a p i / c o r e / v 1 "


Question: What is Namespace?

Answer: N a m e s p a c e   p r o v i d e s   a   s c o p e   f o r   N a m e s .   U s e   o f   m u l t i p l e   n a m e s p a c e s   i s   o p t i o n a l .   a p i V e r s i o n :   v 1 k i n d :   N a m e s p a c e m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( N a m e s p a c e S p e c ) S p e c   d e f i n e s   t h e   b e h a v i o r   o f   t h e   N a m e s p a c e .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s s t a t u s   ( N a m e s p a c e S t a t u s ) S t a t u s   d e s c r i b e s   t h e   c u r r e n t   s t a t u s   o f   a   N a m e s p a c e .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s   a p i V e r s i o n :   v 1   k i n d :   N a m e s p a c e   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( N a m e s p a c e S p e c )   S p e c   d e f i n e s   t h e   b e h a v i o r   o f   t h e   N a m e s p a c e .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s   s t a t u s   ( N a m e s p a c e S t


Question: What is NamespaceSpec?

Answer: N a m e s p a c e S p e c   d e s c r i b e s   t h e   a t t r i b u t e s   o n   a   N a m e s p a c e .   f i n a l i z e r s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e F i n a l i z e r s   i s   a n   o p a q u e   l i s t   o f   v a l u e s   t h a t   m u s t   b e   e m p t y   t o   p e r m a n e n t l y   r e m o v e   o b j e c t   f r o m   s t o r a g e .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / a d m i n i s t e r - c l u s t e r / n a m e s p a c e s /   f i n a l i z e r s   ( [ ] s t r i n g )   A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e   F i n a l i z e r s   i s   a n   o p a q u e   l i s t   o f   v a l u e s   t h a t   m u s t   b e   e m p t y   t o   p e r m a n e n t l y   r e m o v e   o b j e c t   f r o m   s t o r a g e .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / a d m i n i s t e r - c l u s t e r / n a m e s p a c e s /


Question: What is NamespaceStatus?

Answer: N a m e s p a c e S t a t u s   i s   i n f o r m a t i o n   a b o u t   t h e   c u r r e n t   s t a t u s   o f   a   N a m e s p a c e .   c o n d i t i o n s   ( [ ] N a m e s p a c e C o n d i t i o n ) P a t c h   s t r a t e g y :   m e r g e   o n   k e y   t y p e M a p :   u n i q u e   v a l u e s   o n   k e y   t y p e   w i l l   b e   k e p t   d u r i n g   a   m e r g e R e p r e s e n t s   t h e   l a t e s t   a v a i l a b l e   o b s e r v a t i o n s   o f   a   n a m e s p a c e ' s   c u r r e n t   s t a t e . N a m e s p a c e C o n d i t i o n   c o n t a i n s   d e t a i l s   a b o u t   s t a t e   o f   n a m e s p a c e . c o n d i t i o n s . s t a t u s   ( s t r i n g ) ,   r e q u i r e d S t a t u s   o f   t h e   c o n d i t i o n ,   o n e   o f   T r u e ,   F a l s e ,   U n k n o w n . c o n d i t i o n s . t y p e   ( s t r i n g ) ,   r e q u i r e d T y p e   o f   n a m e s p a c e   c o n t r o l l e r   c o n d i t i o n . c o n d i t i o n s . l a s t T r a n s i t i o n T i m e   ( T i m e ) L a s t   t i m e   t h e   c o n d i t i o n   t r a n s i t i o n e d   f r o m   o n e   s t a t u s   t o   a n o t h e r . T i m e   i s   a   w r a p p e r   a r o u n d   t i m e . T i m e   w h i c h   s u p p o r t s   c o r r e c t   m a r s h a l i n g   t o   Y A M L   a n d   J S O N .   W r a p p e r s   a r e   p r o v i d e d   f o r   m a n y   o f   t h e   f a c t o r y   m e t h o d s   t h a t   t h e   t i m e   p a c k a g e   o f f e r s . c o n d i t i o n s . m e s s a g e   ( s t r i n g ) H u m a n - r e a d a b l e   m e s s a g e   i n d i c a t i n g   d e t a i l s   a b o u t   l a s t   t r a n s i t i o n . c o n d i t i o n s . r e a s o n   ( s t r i n g ) U n i q u e ,   o n e - w o r d ,   C a m e l C a s e   r e a s o n   f o r   t h e   c o n d i t i o n ' s   l a s t   t r a n s i t i o n . p h a s e   ( s t r i n g ) P h a s e   i s   t h e   c u r r e n t   l i f e c y c l e   p h


Question: What is NamespaceList?

Answer: N a m e s p a c e L i s t   i s   a   l i s t   o f   N a m e s p a c e s .   a p i V e r s i o n :   v 1 k i n d :   N a m e s p a c e L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s i t e m s   ( [ ] N a m e s p a c e ) ,   r e q u i r e d I t e m s   i s   t h e   l i s t   o f   N a m e s p a c e   o b j e c t s   i n   t h e   l i s t .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / o v e r v i e w / w o r k i n g - w i t h - o b j e c t s / n a m e s p a c e s /   a p i V e r s i o n :   v 1   k i n d :   N a m e s p a c e L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s   i t e m s   ( [ ] N a m e s p a c e ) ,   r e q u i r e d   I t e m s   i s   t h e   l i s t   o f   N a m e s p a c e   o b j e c t s   i n   t h e   l i s t .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / o v e r v i e w / w o r k i n g - w i t h - o b j e c t s / n a m e s p a c e s /


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i / v 1 / n a m e s p a c e s


Question: What is Parameters?

Answer: b o d y :   N a m e s p a c e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   N a m e s p a c e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   2 0 2   ( N a m e s p a c e ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i / v 1 / n a m e s p a c e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   N a m e s p a c e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   N a m e s p a c e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i / v 1 / n a m e s p a c e s / { n a m e } / f i n a l i z e


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   N a m e s p a c e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   N a m e s p a c e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i / v 1 / n a m e s p a c e s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   N a m e s p a c e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   N a m e s p a c e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i / v 1 / n a m e s p a c e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i / v 1 / n a m e s p a c e s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( N a m e s p a c e ) :   O K   2 0 1   ( N a m e s p a c e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i / v 1 / n a m e s p a c e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   N a m e s p a c e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   N a m e s p a c e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   2 0 2   ( S t a t u s ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Cluster Architecture?

Answer: Cluster ArchitectureThe architectural concepts behind Kubernetes.A Kubernetes cluster consists of a control plane plus a set of worker machines, called nodes, that run containerized applications. Every cluster needs at least one worker node in order to run Pods.The worker node(s) host the Pods that are the components of the application workload. The control plane manages the worker nodes and the Pods in the cluster. In production environments, the control plane usually runs across multiple computers and a cluster usually runs multiple nodes, providing fault-tolerance and high availability.This document outlines the various components you need to have for a complete and working Kubernetes cluster.Figure 1. Kubernetes cluster components.About this architectureThe diagram in Figure 1 presents an example reference architecture for a Kubernetes cluster. The actual distribution of components can vary based on specific cluster setups and requirements.In the diagram, each node runs the kube-proxy component. You need a network proxy component on each node to ensure that the Service API and associated behaviors are available on your cluster network. However, some network plugins provide their own, third party implementation of proxying. When you use that kind of network plugin, the node does not need to run kube-proxy.Control plane componentsThe control plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new pod when a Deployment's replicas field is unsatisfied).Control plane components can be run on any machine in the cluster. However, for simplicity, setup scripts typically start all control plane components on the same machine, and do not run user containers on this machine. See Creating Highly Available clusters with kubeadm for an example control plane setup that runs across multiple machines.kube-apiserverThe API server is a component of the Kubernetes control plane that exposes the Kubernetes API. The API server is the front end for the Kubernetes control plane.The main implementation of a Kubernetes API server is kube-apiserver. kube-apiserver is designed to scale horizontally—that is, it scales by deploying more instances. You can run several instances of kube-apiserver and balance traffic between those instances.etcdConsistent and highly-available key value store used as Kubernetes' backing store for all cluster data.If your Kubernetes cluster uses etcd as its backing store, make sure you have a back up plan for the data.You can find in-depth information about etcd in the official documentation.kube-schedulerControl plane component that watches for newly created Pods with no assigned node, and selects a node for them to run on.Factors taken into account for scheduling decisions include: individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, int


Question: How does Cluster Architecture work?

Answer: Cluster ArchitectureThe architectural concepts behind Kubernetes.A Kubernetes cluster consists of a control plane plus a set of worker machines, called nodes, that run containerized applications. Every cluster needs at least one worker node in order to run Pods.The worker node(s) host the Pods that are the components of the application workload. The control plane manages the worker nodes and the Pods in the cluster. In production environments, the control plane usually runs across multiple computers and a cluster usually runs multiple nodes, providing fault-tolerance and high availability.This document outlines the various components you need to have for a complete and working Kubernetes cluster.Figure 1. Kubernetes cluster components.About this architectureThe diagram in Figure 1 presents an example reference architecture for a Kubernetes cluster. The actual distribution of components can vary based on specific cluster setups and requirements.In the diagram, each node runs the kube-proxy component. You need a network proxy component on each node to ensure that the Service API and associated behaviors are available on your cluster network. However, some network plugins provide their own, third party implementation of proxying. When you use that kind of network plugin, the node does not need to run kube-proxy.Control plane componentsThe control plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new pod when a Deployment's replicas field is unsatisfied).Control plane components can be run on any machine in the cluster. However, for simplicity, setup scripts typically start all control plane components on the same machine, and do not run user containers on this machine. See Creating Highly Available clusters with kubeadm for an example control plane setup that runs across multiple machines.kube-apiserverThe API server is a component of the Kubernetes control plane that exposes the Kubernetes API. The API server is the front end for the Kubernetes control plane.The main implementation of a Kubernetes API server is kube-apiserver. kube-apiserver is designed to scale horizontally—that is, it scales by deploying more instances. You can run several instances of kube-apiserver and balance traffic between those instances.etcdConsistent and highly-available key value store used as Kubernetes' backing store for all cluster data.If your Kubernetes cluster uses etcd as its backing store, make sure you have a back up plan for the data.You can find in-depth information about etcd in the official documentation.kube-schedulerControl plane component that watches for newly created Pods with no assigned node, and selects a node for them to run on.Factors taken into account for scheduling decisions include: individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, int


Question: When would you use Cluster Architecture?

Answer: Cluster ArchitectureThe architectural concepts behind Kubernetes.A Kubernetes cluster consists of a control plane plus a set of worker machines, called nodes, that run containerized applications. Every cluster needs at least one worker node in order to run Pods.The worker node(s) host the Pods that are the components of the application workload. The control plane manages the worker nodes and the Pods in the cluster. In production environments, the control plane usually runs across multiple computers and a cluster usually runs multiple nodes, providing fault-tolerance and high availability.This document outlines the various components you need to have for a complete and working Kubernetes cluster.Figure 1. Kubernetes cluster components.About this architectureThe diagram in Figure 1 presents an example reference architecture for a Kubernetes cluster. The actual distribution of components can vary based on specific cluster setups and requirements.In the diagram, each node runs the kube-proxy component. You need a network proxy component on each node to ensure that the Service API and associated behaviors are available on your cluster network. However, some network plugins provide their own, third party implementation of proxying. When you use that kind of network plugin, the node does not need to run kube-proxy.Control plane componentsThe control plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new pod when a Deployment's replicas field is unsatisfied).Control plane components can be run on any machine in the cluster. However, for simplicity, setup scripts typically start all control plane components on the same machine, and do not run user containers on this machine. See Creating Highly Available clusters with kubeadm for an example control plane setup that runs across multiple machines.kube-apiserverThe API server is a component of the Kubernetes control plane that exposes the Kubernetes API. The API server is the front end for the Kubernetes control plane.The main implementation of a Kubernetes API server is kube-apiserver. kube-apiserver is designed to scale horizontally—that is, it scales by deploying more instances. You can run several instances of kube-apiserver and balance traffic between those instances.etcdConsistent and highly-available key value store used as Kubernetes' backing store for all cluster data.If your Kubernetes cluster uses etcd as its backing store, make sure you have a back up plan for the data.You can find in-depth information about etcd in the official documentation.kube-schedulerControl plane component that watches for newly created Pods with no assigned node, and selects a node for them to run on.Factors taken into account for scheduling decisions include: individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, int


Question: What are the benefits of Cluster Architecture?

Answer: Cluster ArchitectureThe architectural concepts behind Kubernetes.A Kubernetes cluster consists of a control plane plus a set of worker machines, called nodes, that run containerized applications. Every cluster needs at least one worker node in order to run Pods.The worker node(s) host the Pods that are the components of the application workload. The control plane manages the worker nodes and the Pods in the cluster. In production environments, the control plane usually runs across multiple computers and a cluster usually runs multiple nodes, providing fault-tolerance and high availability.This document outlines the various components you need to have for a complete and working Kubernetes cluster.Figure 1. Kubernetes cluster components.About this architectureThe diagram in Figure 1 presents an example reference architecture for a Kubernetes cluster. The actual distribution of components can vary based on specific cluster setups and requirements.In the diagram, each node runs the kube-proxy component. You need a network proxy component on each node to ensure that the Service API and associated behaviors are available on your cluster network. However, some network plugins provide their own, third party implementation of proxying. When you use that kind of network plugin, the node does not need to run kube-proxy.Control plane componentsThe control plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new pod when a Deployment's replicas field is unsatisfied).Control plane components can be run on any machine in the cluster. However, for simplicity, setup scripts typically start all control plane components on the same machine, and do not run user containers on this machine. See Creating Highly Available clusters with kubeadm for an example control plane setup that runs across multiple machines.kube-apiserverThe API server is a component of the Kubernetes control plane that exposes the Kubernetes API. The API server is the front end for the Kubernetes control plane.The main implementation of a Kubernetes API server is kube-apiserver. kube-apiserver is designed to scale horizontally—that is, it scales by deploying more instances. You can run several instances of kube-apiserver and balance traffic between those instances.etcdConsistent and highly-available key value store used as Kubernetes' backing store for all cluster data.If your Kubernetes cluster uses etcd as its backing store, make sure you have a back up plan for the data.You can find in-depth information about etcd in the official documentation.kube-schedulerControl plane component that watches for newly created Pods with no assigned node, and selects a node for them to run on.Factors taken into account for scheduling decisions include: individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, int


Question: What is Cluster Architecture?

Answer: A   K u b e r n e t e s   c l u s t e r   c o n s i s t s   o f   a   c o n t r o l   p l a n e   p l u s   a   s e t   o f   w o r k e r   m a c h i n e s ,   c a l l e d   n o d e s ,   t h a t   r u n   c o n t a i n e r i z e d   a p p l i c a t i o n s .   E v e r y   c l u s t e r   n e e d s   a t   l e a s t   o n e   w o r k e r   n o d e   i n   o r d e r   t o   r u n   P o d s .   T h e   w o r k e r   n o d e ( s )   h o s t   t h e   P o d s   t h a t   a r e   t h e   c o m p o n e n t s   o f   t h e   a p p l i c a t i o n   w o r k l o a d .   T h e   c o n t r o l   p l a n e   m a n a g e s   t h e   w o r k e r   n o d e s   a n d   t h e   P o d s   i n   t h e   c l u s t e r .   I n   p r o d u c t i o n   e n v i r o n m e n t s ,   t h e   c o n t r o l   p l a n e   u s u a l l y   r u n s   a c r o s s   m u l t i p l e   c o m p u t e r s   a n d   a   c l u s t e r   u s u a l l y   r u n s   m u l t i p l e   n o d e s ,   p r o v i d i n g   f a u l t - t o l e r a n c e   a n d   h i g h   a v a i l a b i l i t y .   T h i s   d o c u m e n t   o u t l i n e s   t h e   v a r i o u s   c o m p o n e n t s   y o u   n e e d   t o   h a v e   f o r   a   c o m p l e t e   a n d   w o r k i n g   K u b e r n e t e s   c l u s t e r .   F i g u r e   1 .   K u b e r n e t e s   c l u s t e r   c o m p o n e n t s .   T h e   d i a g r a m   i n   F i g u r e   1   p r e s e n t s   a n   e x a m p l e   r e f e r e n c e   a r c h i t e c t u r e   f o r   a   K u b e r n e t e s   c l u s t e r .   T h e   a c t u a l   d i s t r i b u t i o n   o f   c o m p o n e n t s   c a n   v a r y   b a s e d   o n   s p e c i f i c   c l u s t e r   s e t u p s   a n d   r e q u i r e m e n t s .   I n   t h e   d i a g r a m ,   e a c h   n o d e   r u n s   t h e   k u b e - p r o x y   c o m p o n e n t .   Y o u   n e e d   a   n e t w o r k   p r o x y   c o m p o n e n t   o n   e a c h   n o d e   t o   e n s u r e   t h a t   t h e   S


Question: What is Control plane components?

Answer: T h e   c o n t r o l   p l a n e ' s   c o m p o n e n t s   m a k e   g l o b a l   d e c i s i o n s   a b o u t   t h e   c l u s t e r   ( f o r   e x a m p l e ,   s c h e d u l i n g ) ,   a s   w e l l   a s   d e t e c t i n g   a n d   r e s p o n d i n g   t o   c l u s t e r   e v e n t s   ( f o r   e x a m p l e ,   s t a r t i n g   u p   a   n e w   p o d   w h e n   a   D e p l o y m e n t ' s   r e p l i c a s   f i e l d   i s   u n s a t i s f i e d ) .   C o n t r o l   p l a n e   c o m p o n e n t s   c a n   b e   r u n   o n   a n y   m a c h i n e   i n   t h e   c l u s t e r .   H o w e v e r ,   f o r   s i m p l i c i t y ,   s e t u p   s c r i p t s   t y p i c a l l y   s t a r t   a l l   c o n t r o l   p l a n e   c o m p o n e n t s   o n   t h e   s a m e   m a c h i n e ,   a n d   d o   n o t   r u n   u s e r   c o n t a i n e r s   o n   t h i s   m a c h i n e .   S e e   C r e a t i n g   H i g h l y   A v a i l a b l e   c l u s t e r s   w i t h   k u b e a d m   f o r   a n   e x a m p l e   c o n t r o l   p l a n e   s e t u p   t h a t   r u n s   a c r o s s   m u l t i p l e   m a c h i n e s .


Question: What is kube-apiserver?

Answer: T h e   A P I   s e r v e r   i s   a   c o m p o n e n t   o f   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   t h a t   e x p o s e s   t h e   K u b e r n e t e s   A P I .   T h e   A P I   s e r v e r   i s   t h e   f r o n t   e n d   f o r   t h e   K u b e r n e t e s   c o n t r o l   p l a n e .   T h e   m a i n   i m p l e m e n t a t i o n   o f   a   K u b e r n e t e s   A P I   s e r v e r   i s   k u b e - a p i s e r v e r .   k u b e - a p i s e r v e r   i s   d e s i g n e d   t o   s c a l e   h o r i z o n t a l l y — t h a t   i s ,   i t   s c a l e s   b y   d e p l o y i n g   m o r e   i n s t a n c e s .   Y o u   c a n   r u n   s e v e r a l   i n s t a n c e s   o f   k u b e - a p i s e r v e r   a n d   b a l a n c e   t r a f f i c   b e t w e e n   t h o s e   i n s t a n c e s .


Question: What is etcd?

Answer: C o n s i s t e n t   a n d   h i g h l y - a v a i l a b l e   k e y   v a l u e   s t o r e   u s e d   a s   K u b e r n e t e s '   b a c k i n g   s t o r e   f o r   a l l   c l u s t e r   d a t a .   I f   y o u r   K u b e r n e t e s   c l u s t e r   u s e s   e t c d   a s   i t s   b a c k i n g   s t o r e ,   m a k e   s u r e   y o u   h a v e   a   b a c k   u p   p l a n   f o r   t h e   d a t a .   Y o u   c a n   f i n d   i n - d e p t h   i n f o r m a t i o n   a b o u t   e t c d   i n   t h e   o f f i c i a l   d o c u m e n t a t i o n .


Question: What is kube-scheduler?

Answer: C o n t r o l   p l a n e   c o m p o n e n t   t h a t   w a t c h e s   f o r   n e w l y   c r e a t e d   P o d s   w i t h   n o   a s s i g n e d   n o d e ,   a n d   s e l e c t s   a   n o d e   f o r   t h e m   t o   r u n   o n .   F a c t o r s   t a k e n   i n t o   a c c o u n t   f o r   s c h e d u l i n g   d e c i s i o n s   i n c l u d e :   i n d i v i d u a l   a n d   c o l l e c t i v e   r e s o u r c e   r e q u i r e m e n t s ,   h a r d w a r e / s o f t w a r e / p o l i c y   c o n s t r a i n t s ,   a f f i n i t y   a n d   a n t i - a f f i n i t y   s p e c i f i c a t i o n s ,   d a t a   l o c a l i t y ,   i n t e r - w o r k l o a d   i n t e r f e r e n c e ,   a n d   d e a d l i n e s .


Question: What is kube-controller-manager?

Answer: C o n t r o l   p l a n e   c o m p o n e n t   t h a t   r u n s   c o n t r o l l e r   p r o c e s s e s .   L o g i c a l l y ,   e a c h   c o n t r o l l e r   i s   a   s e p a r a t e   p r o c e s s ,   b u t   t o   r e d u c e   c o m p l e x i t y ,   t h e y   a r e   a l l   c o m p i l e d   i n t o   a   s i n g l e   b i n a r y   a n d   r u n   i n   a   s i n g l e   p r o c e s s .   T h e r e   a r e   m a n y   d i f f e r e n t   t y p e s   o f   c o n t r o l l e r s .   S o m e   e x a m p l e s   o f   t h e m   a r e :   N o d e   c o n t r o l l e r :   R e s p o n s i b l e   f o r   n o t i c i n g   a n d   r e s p o n d i n g   w h e n   n o d e s   g o   d o w n . J o b   c o n t r o l l e r :   W a t c h e s   f o r   J o b   o b j e c t s   t h a t   r e p r e s e n t   o n e - o f f   t a s k s ,   t h e n   c r e a t e s   P o d s   t o   r u n   t h o s e   t a s k s   t o   c o m p l e t i o n . E n d p o i n t S l i c e   c o n t r o l l e r :   P o p u l a t e s   E n d p o i n t S l i c e   o b j e c t s   ( t o   p r o v i d e   a   l i n k   b e t w e e n   S e r v i c e s   a n d   P o d s ) . S e r v i c e A c c o u n t   c o n t r o l l e r :   C r e a t e   d e f a u l t   S e r v i c e A c c o u n t s   f o r   n e w   n a m e s p a c e s .   T h e   a b o v e   i s   n o t   a n   e x h a u s t i v e   l i s t .


Question: What is cloud-controller-manager?

Answer: T h e   c l o u d - c o n t r o l l e r - m a n a g e r   o n l y   r u n s   c o n t r o l l e r s   t h a t   a r e   s p e c i f i c   t o   y o u r   c l o u d   p r o v i d e r .   I f   y o u   a r e   r u n n i n g   K u b e r n e t e s   o n   y o u r   o w n   p r e m i s e s ,   o r   i n   a   l e a r n i n g   e n v i r o n m e n t   i n s i d e   y o u r   o w n   P C ,   t h e   c l u s t e r   d o e s   n o t   h a v e   a   c l o u d   c o n t r o l l e r   m a n a g e r .   A s   w i t h   t h e   k u b e - c o n t r o l l e r - m a n a g e r ,   t h e   c l o u d - c o n t r o l l e r - m a n a g e r   c o m b i n e s   s e v e r a l   l o g i c a l l y   i n d e p e n d e n t   c o n t r o l   l o o p s   i n t o   a   s i n g l e   b i n a r y   t h a t   y o u   r u n   a s   a   s i n g l e   p r o c e s s .   Y o u   c a n   s c a l e   h o r i z o n t a l l y   ( r u n   m o r e   t h a n   o n e   c o p y )   t o   i m p r o v e   p e r f o r m a n c e   o r   t o   h e l p   t o l e r a t e   f a i l u r e s .   T h e   f o l l o w i n g   c o n t r o l l e r s   c a n   h a v e   c l o u d   p r o v i d e r   d e p e n d e n c i e s :   N o d e   c o n t r o l l e r :   F o r   c h e c k i n g   t h e   c l o u d   p r o v i d e r   t o   d e t e r m i n e   i f   a   n o d e   h a s   b e e n   d e l e t e d   i n   t h e   c l o u d   a f t e r   i t   s t o p s   r e s p o n d i n g R o u t e   c o n t r o l l e r :   F o r   s e t t i n g   u p   r o u t e s   i n   t h e   u n d e r l y i n g   c l o u d   i n f r a s t r u c t u r e S e r v i c e   c o n t r o l l e r :   F o r   c r e a t i n g ,   u p d a t i n g   a n d   d e l e t i n g   c l o u d   p r o v i d e r   l o a d   b a l a n c e r s


Question: What is Node components?

Answer: N o d e   c o m p o n e n t s   r u n   o n   e v e r y   n o d e ,   m a i n t a i n i n g   r u n n i n g   p o d s   a n d   p r o v i d i n g   t h e   K u b e r n e t e s   r u n t i m e   e n v i r o n m e n t .


Question: What is kubelet?

Answer: A n   a g e n t   t h a t   r u n s   o n   e a c h   n o d e   i n   t h e   c l u s t e r .   I t   m a k e s   s u r e   t h a t   c o n t a i n e r s   a r e   r u n n i n g   i n   a   P o d .   T h e   k u b e l e t   t a k e s   a   s e t   o f   P o d S p e c s   t h a t   a r e   p r o v i d e d   t h r o u g h   v a r i o u s   m e c h a n i s m s   a n d   e n s u r e s   t h a t   t h e   c o n t a i n e r s   d e s c r i b e d   i n   t h o s e   P o d S p e c s   a r e   r u n n i n g   a n d   h e a l t h y .   T h e   k u b e l e t   d o e s n ' t   m a n a g e   c o n t a i n e r s   w h i c h   w e r e   n o t   c r e a t e d   b y   K u b e r n e t e s .


Question: What is kube-proxy (optional)?

Answer: k u b e - p r o x y   i s   a   n e t w o r k   p r o x y   t h a t   r u n s   o n   e a c h   n o d e   i n   y o u r   c l u s t e r ,   i m p l e m e n t i n g   p a r t   o f   t h e   K u b e r n e t e s   S e r v i c e   c o n c e p t . k u b e - p r o x y   m a i n t a i n s   n e t w o r k   r u l e s   o n   n o d e s .   T h e s e   n e t w o r k   r u l e s   a l l o w   n e t w o r k   c o m m u n i c a t i o n   t o   y o u r   P o d s   f r o m   n e t w o r k   s e s s i o n s   i n s i d e   o r   o u t s i d e   o f   y o u r   c l u s t e r . k u b e - p r o x y   u s e s   t h e   o p e r a t i n g   s y s t e m   p a c k e t   f i l t e r i n g   l a y e r   i f   t h e r e   i s   o n e   a n d   i t ' s   a v a i l a b l e .   O t h e r w i s e ,   k u b e - p r o x y   f o r w a r d s   t h e   t r a f f i c   i t s e l f . I f   y o u   u s e   a   n e t w o r k   p l u g i n   t h a t   i m p l e m e n t s   p a c k e t   f o r w a r d i n g   f o r   S e r v i c e s   b y   i t s e l f ,   a n d   p r o v i d i n g   e q u i v a l e n t   b e h a v i o r   t o   k u b e - p r o x y ,   t h e n   y o u   d o   n o t   n e e d   t o   r u n   k u b e - p r o x y   o n   t h e   n o d e s   i n   y o u r   c l u s t e r .   k u b e - p r o x y   i s   a   n e t w o r k   p r o x y   t h a t   r u n s   o n   e a c h   n o d e   i n   y o u r   c l u s t e r ,   i m p l e m e n t i n g   p a r t   o f   t h e   K u b e r n e t e s   S e r v i c e   c o n c e p t .   k u b e - p r o x y   m a i n t a i n s   n e t w o r k   r u l e s   o n   n o d e s .   T h e s e   n e t w o r k   r u l e s   a l l o w   n e t w o r k   c o m m u n i c a t i o n   t o   y o u r   P o d s   f r o m   n e t w o r k   s e s s i o n s   i n s i d e   o r   o u t s i d e   o f   y o u r   c l u s t e r .   k u b e - p r o x y   u s e s   t h e   o p e r a t i n g   s y s t e m   p a c k e t   f i l t e r i n g   l a y e r   i f   t h e r e   i s   o n e   a n d


Question: What is Container runtime?

Answer: A   f u n d a m e n t a l   c o m p o n e n t   t h a t   e m p o w e r s   K u b e r n e t e s   t o   r u n   c o n t a i n e r s   e f f e c t i v e l y .   I t   i s   r e s p o n s i b l e   f o r   m a n a g i n g   t h e   e x e c u t i o n   a n d   l i f e c y c l e   o f   c o n t a i n e r s   w i t h i n   t h e   K u b e r n e t e s   e n v i r o n m e n t .   K u b e r n e t e s   s u p p o r t s   c o n t a i n e r   r u n t i m e s   s u c h   a s   c o n t a i n e r d ,   C R I - O ,   a n d   a n y   o t h e r   i m p l e m e n t a t i o n   o f   t h e   K u b e r n e t e s   C R I   ( C o n t a i n e r   R u n t i m e   I n t e r f a c e ) .


Question: What is Addons?

Answer: A d d o n s   u s e   K u b e r n e t e s   r e s o u r c e s   ( D a e m o n S e t ,   D e p l o y m e n t ,   e t c )   t o   i m p l e m e n t   c l u s t e r   f e a t u r e s .   B e c a u s e   t h e s e   a r e   p r o v i d i n g   c l u s t e r - l e v e l   f e a t u r e s ,   n a m e s p a c e d   r e s o u r c e s   f o r   a d d o n s   b e l o n g   w i t h i n   t h e   k u b e - s y s t e m   n a m e s p a c e .   S e l e c t e d   a d d o n s   a r e   d e s c r i b e d   b e l o w ;   f o r   a n   e x t e n d e d   l i s t   o f   a v a i l a b l e   a d d o n s ,   p l e a s e   s e e   A d d o n s .


Question: What is DNS?

Answer: W h i l e   t h e   o t h e r   a d d o n s   a r e   n o t   s t r i c t l y   r e q u i r e d ,   a l l   K u b e r n e t e s   c l u s t e r s   s h o u l d   h a v e   c l u s t e r   D N S ,   a s   m a n y   e x a m p l e s   r e l y   o n   i t .   C l u s t e r   D N S   i s   a   D N S   s e r v e r ,   i n   a d d i t i o n   t o   t h e   o t h e r   D N S   s e r v e r ( s )   i n   y o u r   e n v i r o n m e n t ,   w h i c h   s e r v e s   D N S   r e c o r d s   f o r   K u b e r n e t e s   s e r v i c e s .   C o n t a i n e r s   s t a r t e d   b y   K u b e r n e t e s   a u t o m a t i c a l l y   i n c l u d e   t h i s   D N S   s e r v e r   i n   t h e i r   D N S   s e a r c h e s .


Question: What is Web UI (Dashboard)?

Answer: D a s h b o a r d   i s   a   g e n e r a l   p u r p o s e ,   w e b - b a s e d   U I   f o r   K u b e r n e t e s   c l u s t e r s .   I t   a l l o w s   u s e r s   t o   m a n a g e   a n d   t r o u b l e s h o o t   a p p l i c a t i o n s   r u n n i n g   i n   t h e   c l u s t e r ,   a s   w e l l   a s   t h e   c l u s t e r   i t s e l f .


Question: What is Container resource monitoring?

Answer: C o n t a i n e r   R e s o u r c e   M o n i t o r i n g   r e c o r d s   g e n e r i c   t i m e - s e r i e s   m e t r i c s   a b o u t   c o n t a i n e r s   i n   a   c e n t r a l   d a t a b a s e ,   a n d   p r o v i d e s   a   U I   f o r   b r o w s i n g   t h a t   d a t a .


Question: What is Cluster-level Logging?

Answer: A   c l u s t e r - l e v e l   l o g g i n g   m e c h a n i s m   i s   r e s p o n s i b l e   f o r   s a v i n g   c o n t a i n e r   l o g s   t o   a   c e n t r a l   l o g   s t o r e   w i t h   a   s e a r c h / b r o w s i n g   i n t e r f a c e .


Question: What is Network plugins?

Answer: N e t w o r k   p l u g i n s   a r e   s o f t w a r e   c o m p o n e n t s   t h a t   i m p l e m e n t   t h e   c o n t a i n e r   n e t w o r k   i n t e r f a c e   ( C N I )   s p e c i f i c a t i o n .   T h e y   a r e   r e s p o n s i b l e   f o r   a l l o c a t i n g   I P   a d d r e s s e s   t o   p o d s   a n d   e n a b l i n g   t h e m   t o   c o m m u n i c a t e   w i t h   e a c h   o t h e r   w i t h i n   t h e   c l u s t e r .


Question: What is Architecture variations?

Answer: W h i l e   t h e   c o r e   c o m p o n e n t s   o f   K u b e r n e t e s   r e m a i n   c o n s i s t e n t ,   t h e   w a y   t h e y   a r e   d e p l o y e d   a n d   m a n a g e d   c a n   v a r y .   U n d e r s t a n d i n g   t h e s e   v a r i a t i o n s   i s   c r u c i a l   f o r   d e s i g n i n g   a n d   m a i n t a i n i n g   K u b e r n e t e s   c l u s t e r s   t h a t   m e e t   s p e c i f i c   o p e r a t i o n a l   n e e d s .


Question: What is Control plane deployment options?

Answer: T h e   c o n t r o l   p l a n e   c o m p o n e n t s   c a n   b e   d e p l o y e d   i n   s e v e r a l   w a y s :


Question: What is Workload placement considerations?

Answer: T h e   p l a c e m e n t   o f   w o r k l o a d s ,   i n c l u d i n g   t h e   c o n t r o l   p l a n e   c o m p o n e n t s ,   c a n   v a r y   b a s e d   o n   c l u s t e r   s i z e ,   p e r f o r m a n c e   r e q u i r e m e n t s ,   a n d   o p e r a t i o n a l   p o l i c i e s :   I n   s m a l l e r   o r   d e v e l o p m e n t   c l u s t e r s ,   c o n t r o l   p l a n e   c o m p o n e n t s   a n d   u s e r   w o r k l o a d s   m i g h t   r u n   o n   t h e   s a m e   n o d e s . L a r g e r   p r o d u c t i o n   c l u s t e r s   o f t e n   d e d i c a t e   s p e c i f i c   n o d e s   t o   c o n t r o l   p l a n e   c o m p o n e n t s ,   s e p a r a t i n g   t h e m   f r o m   u s e r   w o r k l o a d s . S o m e   o r g a n i z a t i o n s   r u n   c r i t i c a l   a d d - o n s   o r   m o n i t o r i n g   t o o l s   o n   c o n t r o l   p l a n e   n o d e s .


Question: What is Cluster management tools?

Answer: T o o l s   l i k e   k u b e a d m ,   k o p s ,   a n d   K u b e s p r a y   o f f e r   d i f f e r e n t   a p p r o a c h e s   t o   d e p l o y i n g   a n d   m a n a g i n g   c l u s t e r s ,   e a c h   w i t h   i t s   o w n   m e t h o d   o f   c o m p o n e n t   l a y o u t   a n d   m a n a g e m e n t .   T h e   f l e x i b i l i t y   o f   K u b e r n e t e s   a r c h i t e c t u r e   a l l o w s   o r g a n i z a t i o n s   t o   t a i l o r   t h e i r   c l u s t e r s   t o   s p e c i f i c   n e e d s ,   b a l a n c i n g   f a c t o r s   s u c h   a s   o p e r a t i o n a l   c o m p l e x i t y ,   p e r f o r m a n c e ,   a n d   m a n a g e m e n t   o v e r h e a d .


Question: What is Customization and extensibility?

Answer: K u b e r n e t e s   a r c h i t e c t u r e   a l l o w s   f o r   s i g n i f i c a n t   c u s t o m i z a t i o n :   C u s t o m   s c h e d u l e r s   c a n   b e   d e p l o y e d   t o   w o r k   a l o n g s i d e   t h e   d e f a u l t   K u b e r n e t e s   s c h e d u l e r   o r   t o   r e p l a c e   i t   e n t i r e l y . A P I   s e r v e r s   c a n   b e   e x t e n d e d   w i t h   C u s t o m R e s o u r c e D e f i n i t i o n s   a n d   A P I   A g g r e g a t i o n . C l o u d   p r o v i d e r s   c a n   i n t e g r a t e   d e e p l y   w i t h   K u b e r n e t e s   u s i n g   t h e   c l o u d - c o n t r o l l e r - m a n a g e r .   T h e   f l e x i b i l i t y   o f   K u b e r n e t e s   a r c h i t e c t u r e   a l l o w s   o r g a n i z a t i o n s   t o   t a i l o r   t h e i r   c l u s t e r s   t o   s p e c i f i c   n e e d s ,   b a l a n c i n g   f a c t o r s   s u c h   a s   o p e r a t i o n a l   c o m p l e x i t y ,   p e r f o r m a n c e ,   a n d   m a n a g e m e n t   o v e r h e a d .


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   t h e   f o l l o w i n g :   N o d e s   a n d   t h e i r   c o m m u n i c a t i o n   w i t h   t h e   c o n t r o l   p l a n e . K u b e r n e t e s   c o n t r o l l e r s . k u b e - s c h e d u l e r   w h i c h   i s   t h e   d e f a u l t   s c h e d u l e r   f o r   K u b e r n e t e s . E t c d ' s   o f f i c i a l   d o c u m e n t a t i o n . S e v e r a l   c o n t a i n e r   r u n t i m e s   i n   K u b e r n e t e s . I n t e g r a t i n g   w i t h   c l o u d   p r o v i d e r s   u s i n g   c l o u d - c o n t r o l l e r - m a n a g e r . k u b e c t l   c o m m a n d s .


Question: What is Installing Addons?

Answer: Installing AddonsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Add-ons extend the functionality of Kubernetes.This page lists some of the available add-ons and links to their respective installation instructions. The list does not try to be exhaustive.Networking and Network PolicyACI provides integrated container networking and network security with Cisco ACI.Antrea operates at Layer 3/4 to provide networking and security services for Kubernetes, leveraging Open vSwitch as the networking data plane. Antrea is a CNCF project at the Sandbox level.Calico is a networking and network policy provider. Calico supports a flexible set of networking options so you can choose the most efficient option for your situation, including non-overlay and overlay networks, with or without BGP. Calico uses the same engine to enforce network policy for hosts, pods, and (if using Istio & Envoy) applications at the service mesh layer.Canal unites Flannel and Calico, providing networking and network policy.Cilium is a networking, observability, and security solution with an eBPF-based data plane. Cilium provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay/encapsulation mode, and can enforce network policies on L3-L7 using an identity-based security model that is decoupled from network addressing. Cilium can act as a replacement for kube-proxy; it also offers additional, opt-in observability and security features. Cilium is a CNCF project at the Graduated level.CNI-Genie enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, or Weave. CNI-Genie is a CNCF project at the Sandbox level.Contiv provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully open sourced. The installer provides both kubeadm and non-kubeadm based installation options.Contrail, based on Tungsten Fabric, is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads.Flannel is an overlay network provider that can be used with Kubernetes.Gateway API is an open source project managed by the SIG Network community and provides an expressive, extensible, and role-oriented API for modeling service networking.Knitter is a plugin to support multiple network interfaces in a Kubernetes pod.Multus is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico,


Question: How does Installing Addons work?

Answer: Installing AddonsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Add-ons extend the functionality of Kubernetes.This page lists some of the available add-ons and links to their respective installation instructions. The list does not try to be exhaustive.Networking and Network PolicyACI provides integrated container networking and network security with Cisco ACI.Antrea operates at Layer 3/4 to provide networking and security services for Kubernetes, leveraging Open vSwitch as the networking data plane. Antrea is a CNCF project at the Sandbox level.Calico is a networking and network policy provider. Calico supports a flexible set of networking options so you can choose the most efficient option for your situation, including non-overlay and overlay networks, with or without BGP. Calico uses the same engine to enforce network policy for hosts, pods, and (if using Istio & Envoy) applications at the service mesh layer.Canal unites Flannel and Calico, providing networking and network policy.Cilium is a networking, observability, and security solution with an eBPF-based data plane. Cilium provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay/encapsulation mode, and can enforce network policies on L3-L7 using an identity-based security model that is decoupled from network addressing. Cilium can act as a replacement for kube-proxy; it also offers additional, opt-in observability and security features. Cilium is a CNCF project at the Graduated level.CNI-Genie enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, or Weave. CNI-Genie is a CNCF project at the Sandbox level.Contiv provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully open sourced. The installer provides both kubeadm and non-kubeadm based installation options.Contrail, based on Tungsten Fabric, is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads.Flannel is an overlay network provider that can be used with Kubernetes.Gateway API is an open source project managed by the SIG Network community and provides an expressive, extensible, and role-oriented API for modeling service networking.Knitter is a plugin to support multiple network interfaces in a Kubernetes pod.Multus is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico,


Question: When would you use Installing Addons?

Answer: Installing AddonsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Add-ons extend the functionality of Kubernetes.This page lists some of the available add-ons and links to their respective installation instructions. The list does not try to be exhaustive.Networking and Network PolicyACI provides integrated container networking and network security with Cisco ACI.Antrea operates at Layer 3/4 to provide networking and security services for Kubernetes, leveraging Open vSwitch as the networking data plane. Antrea is a CNCF project at the Sandbox level.Calico is a networking and network policy provider. Calico supports a flexible set of networking options so you can choose the most efficient option for your situation, including non-overlay and overlay networks, with or without BGP. Calico uses the same engine to enforce network policy for hosts, pods, and (if using Istio & Envoy) applications at the service mesh layer.Canal unites Flannel and Calico, providing networking and network policy.Cilium is a networking, observability, and security solution with an eBPF-based data plane. Cilium provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay/encapsulation mode, and can enforce network policies on L3-L7 using an identity-based security model that is decoupled from network addressing. Cilium can act as a replacement for kube-proxy; it also offers additional, opt-in observability and security features. Cilium is a CNCF project at the Graduated level.CNI-Genie enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, or Weave. CNI-Genie is a CNCF project at the Sandbox level.Contiv provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully open sourced. The installer provides both kubeadm and non-kubeadm based installation options.Contrail, based on Tungsten Fabric, is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads.Flannel is an overlay network provider that can be used with Kubernetes.Gateway API is an open source project managed by the SIG Network community and provides an expressive, extensible, and role-oriented API for modeling service networking.Knitter is a plugin to support multiple network interfaces in a Kubernetes pod.Multus is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico,


Question: What are the benefits of Installing Addons?

Answer: Installing AddonsNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Add-ons extend the functionality of Kubernetes.This page lists some of the available add-ons and links to their respective installation instructions. The list does not try to be exhaustive.Networking and Network PolicyACI provides integrated container networking and network security with Cisco ACI.Antrea operates at Layer 3/4 to provide networking and security services for Kubernetes, leveraging Open vSwitch as the networking data plane. Antrea is a CNCF project at the Sandbox level.Calico is a networking and network policy provider. Calico supports a flexible set of networking options so you can choose the most efficient option for your situation, including non-overlay and overlay networks, with or without BGP. Calico uses the same engine to enforce network policy for hosts, pods, and (if using Istio & Envoy) applications at the service mesh layer.Canal unites Flannel and Calico, providing networking and network policy.Cilium is a networking, observability, and security solution with an eBPF-based data plane. Cilium provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay/encapsulation mode, and can enforce network policies on L3-L7 using an identity-based security model that is decoupled from network addressing. Cilium can act as a replacement for kube-proxy; it also offers additional, opt-in observability and security features. Cilium is a CNCF project at the Graduated level.CNI-Genie enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, or Weave. CNI-Genie is a CNCF project at the Sandbox level.Contiv provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully open sourced. The installer provides both kubeadm and non-kubeadm based installation options.Contrail, based on Tungsten Fabric, is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads.Flannel is an overlay network provider that can be used with Kubernetes.Gateway API is an open source project managed by the SIG Network community and provides an expressive, extensible, and role-oriented API for modeling service networking.Knitter is a plugin to support multiple network interfaces in a Kubernetes pod.Multus is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico,


Question: What is Installing Addons?

Answer: A d d - o n s   e x t e n d   t h e   f u n c t i o n a l i t y   o f   K u b e r n e t e s .   T h i s   p a g e   l i s t s   s o m e   o f   t h e   a v a i l a b l e   a d d - o n s   a n d   l i n k s   t o   t h e i r   r e s p e c t i v e   i n s t a l l a t i o n   i n s t r u c t i o n s .   T h e   l i s t   d o e s   n o t   t r y   t o   b e   e x h a u s t i v e .


Question: What is Networking and Network Policy?

Answer: A C I   p r o v i d e s   i n t e g r a t e d   c o n t a i n e r   n e t w o r k i n g   a n d   n e t w o r k   s e c u r i t y   w i t h   C i s c o   A C I . A n t r e a   o p e r a t e s   a t   L a y e r   3 / 4   t o   p r o v i d e   n e t w o r k i n g   a n d   s e c u r i t y   s e r v i c e s   f o r   K u b e r n e t e s ,   l e v e r a g i n g   O p e n   v S w i t c h   a s   t h e   n e t w o r k i n g   d a t a   p l a n e .   A n t r e a   i s   a   C N C F   p r o j e c t   a t   t h e   S a n d b o x   l e v e l . C a l i c o   i s   a   n e t w o r k i n g   a n d   n e t w o r k   p o l i c y   p r o v i d e r .   C a l i c o   s u p p o r t s   a   f l e x i b l e   s e t   o f   n e t w o r k i n g   o p t i o n s   s o   y o u   c a n   c h o o s e   t h e   m o s t   e f f i c i e n t   o p t i o n   f o r   y o u r   s i t u a t i o n ,   i n c l u d i n g   n o n - o v e r l a y   a n d   o v e r l a y   n e t w o r k s ,   w i t h   o r   w i t h o u t   B G P .   C a l i c o   u s e s   t h e   s a m e   e n g i n e   t o   e n f o r c e   n e t w o r k   p o l i c y   f o r   h o s t s ,   p o d s ,   a n d   ( i f   u s i n g   I s t i o   &   E n v o y )   a p p l i c a t i o n s   a t   t h e   s e r v i c e   m e s h   l a y e r . C a n a l   u n i t e s   F l a n n e l   a n d   C a l i c o ,   p r o v i d i n g   n e t w o r k i n g   a n d   n e t w o r k   p o l i c y . C i l i u m   i s   a   n e t w o r k i n g ,   o b s e r v a b i l i t y ,   a n d   s e c u r i t y   s o l u t i o n   w i t h   a n   e B P F - b a s e d   d a t a   p l a n e .   C i l i u m   p r o v i d e s   a   s i m p l e   f l a t   L a y e r   3   n e t w o r k   w i t h   t h e   a b i l i t y   t o   s p a n   m u l t i p l e   c l u s t e r s   i n   e i t h e r   a   n a t i v e   r o u t i n g   o r   o v e r l a y / e n c a p s u l a t i o n   m o d e ,   a n d   c a n   e n f o r c e   n e t w o r k   p o l i c i e s   o n   L 3 - L 7   u s i


Question: What is Service Discovery?

Answer: C o r e D N S   i s   a   f l e x i b l e ,   e x t e n s i b l e   D N S   s e r v e r   w h i c h   c a n   b e   i n s t a l l e d   a s   t h e   i n - c l u s t e r   D N S   f o r   p o d s .


Question: What is Visualization & Control?

Answer: D a s h b o a r d   i s   a   d a s h b o a r d   w e b   i n t e r f a c e   f o r   K u b e r n e t e s .


Question: What is Infrastructure?

Answer: K u b e V i r t   i s   a n   a d d - o n   t o   r u n   v i r t u a l   m a c h i n e s   o n   K u b e r n e t e s .   U s u a l l y   r u n   o n   b a r e - m e t a l   c l u s t e r s . T h e   n o d e   p r o b l e m   d e t e c t o r   r u n s   o n   L i n u x   n o d e s   a n d   r e p o r t s   s y s t e m   i s s u e s   a s   e i t h e r   E v e n t s   o r   N o d e   c o n d i t i o n s .


Question: What is Instrumentation?

Answer: k u b e - s t a t e - m e t r i c s


Question: What is Legacy Add-ons?

Answer: T h e r e   a r e   s e v e r a l   o t h e r   a d d - o n s   d o c u m e n t e d   i n   t h e   d e p r e c a t e d   c l u s t e r / a d d o n s   d i r e c t o r y .   W e l l - m a i n t a i n e d   o n e s   s h o u l d   b e   l i n k e d   t o   h e r e .   P R s   w e l c o m e !   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Using ABAC Authorization?

Answer: Using ABAC AuthorizationAttribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.Policy File FormatTo enable ABAC mode, specify --authorization-policy-file=SOME_FILENAME and --authorization-mode=ABAC on startup.The file format is one JSON object per line. There should be no enclosing list or map, only one map per line.Each line is a "policy object", where each such object is a map with the following properties:Versioning properties:apiVersion, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.kind, type string: valid values are "Policy". Allows versioning and conversion of the policy format.spec property set to a map with the following properties:Subject-matching properties:user, type string; the user-string from --token-auth-file. If you specify user, it must match the username of the authenticated user.group, type string; if you specify group, it must match one of the groups of the authenticated user. system:authenticated matches all authenticated requests. system:unauthenticated matches all unauthenticated requests.Resource-matching properties:apiGroup, type string; an API group.Ex: apps, networking.k8s.ioWildcard: * matches all API groups.namespace, type string; a namespace.Ex: kube-systemWildcard: * matches all resource requests.resource, type string; a resource typeEx: pods, deploymentsWildcard: * matches all resource requests.Non-resource-matching properties:nonResourcePath, type string; non-resource request paths.Ex: /version or /apisWildcard:* matches all non-resource requests./foo/* matches all subpaths of /foo/.readonly, type boolean, when true, means that the Resource-matching policy only applies to get, list, and watch operations, Non-resource-matching policy only applies to get operation.Note:An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). However, unset should be preferred for readability.In the future, policies may be expressed in a JSON format, and managed via a REST interface.Authorization AlgorithmA request has attributes which correspond to the properties of a policy object.When a request is received, the attributes are determined. Unknown attributes are set to the zero value of its type (e.g. empty string, 0, false).A property set to "*" will match any value of the corresponding attribute.The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation).To permit any authenticated user to do something, write a policy with the group property set to "system:authenticated".To permit any unauthenticated user to do something, write a policy with the group property set to "system:unauthenticated".To permit a user to do anything, write a pol


Question: How does Using ABAC Authorization work?

Answer: Using ABAC AuthorizationAttribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.Policy File FormatTo enable ABAC mode, specify --authorization-policy-file=SOME_FILENAME and --authorization-mode=ABAC on startup.The file format is one JSON object per line. There should be no enclosing list or map, only one map per line.Each line is a "policy object", where each such object is a map with the following properties:Versioning properties:apiVersion, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.kind, type string: valid values are "Policy". Allows versioning and conversion of the policy format.spec property set to a map with the following properties:Subject-matching properties:user, type string; the user-string from --token-auth-file. If you specify user, it must match the username of the authenticated user.group, type string; if you specify group, it must match one of the groups of the authenticated user. system:authenticated matches all authenticated requests. system:unauthenticated matches all unauthenticated requests.Resource-matching properties:apiGroup, type string; an API group.Ex: apps, networking.k8s.ioWildcard: * matches all API groups.namespace, type string; a namespace.Ex: kube-systemWildcard: * matches all resource requests.resource, type string; a resource typeEx: pods, deploymentsWildcard: * matches all resource requests.Non-resource-matching properties:nonResourcePath, type string; non-resource request paths.Ex: /version or /apisWildcard:* matches all non-resource requests./foo/* matches all subpaths of /foo/.readonly, type boolean, when true, means that the Resource-matching policy only applies to get, list, and watch operations, Non-resource-matching policy only applies to get operation.Note:An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). However, unset should be preferred for readability.In the future, policies may be expressed in a JSON format, and managed via a REST interface.Authorization AlgorithmA request has attributes which correspond to the properties of a policy object.When a request is received, the attributes are determined. Unknown attributes are set to the zero value of its type (e.g. empty string, 0, false).A property set to "*" will match any value of the corresponding attribute.The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation).To permit any authenticated user to do something, write a policy with the group property set to "system:authenticated".To permit any unauthenticated user to do something, write a policy with the group property set to "system:unauthenticated".To permit a user to do anything, write a pol


Question: When would you use Using ABAC Authorization?

Answer: Using ABAC AuthorizationAttribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.Policy File FormatTo enable ABAC mode, specify --authorization-policy-file=SOME_FILENAME and --authorization-mode=ABAC on startup.The file format is one JSON object per line. There should be no enclosing list or map, only one map per line.Each line is a "policy object", where each such object is a map with the following properties:Versioning properties:apiVersion, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.kind, type string: valid values are "Policy". Allows versioning and conversion of the policy format.spec property set to a map with the following properties:Subject-matching properties:user, type string; the user-string from --token-auth-file. If you specify user, it must match the username of the authenticated user.group, type string; if you specify group, it must match one of the groups of the authenticated user. system:authenticated matches all authenticated requests. system:unauthenticated matches all unauthenticated requests.Resource-matching properties:apiGroup, type string; an API group.Ex: apps, networking.k8s.ioWildcard: * matches all API groups.namespace, type string; a namespace.Ex: kube-systemWildcard: * matches all resource requests.resource, type string; a resource typeEx: pods, deploymentsWildcard: * matches all resource requests.Non-resource-matching properties:nonResourcePath, type string; non-resource request paths.Ex: /version or /apisWildcard:* matches all non-resource requests./foo/* matches all subpaths of /foo/.readonly, type boolean, when true, means that the Resource-matching policy only applies to get, list, and watch operations, Non-resource-matching policy only applies to get operation.Note:An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). However, unset should be preferred for readability.In the future, policies may be expressed in a JSON format, and managed via a REST interface.Authorization AlgorithmA request has attributes which correspond to the properties of a policy object.When a request is received, the attributes are determined. Unknown attributes are set to the zero value of its type (e.g. empty string, 0, false).A property set to "*" will match any value of the corresponding attribute.The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation).To permit any authenticated user to do something, write a policy with the group property set to "system:authenticated".To permit any unauthenticated user to do something, write a policy with the group property set to "system:unauthenticated".To permit a user to do anything, write a pol


Question: What are the benefits of Using ABAC Authorization?

Answer: Using ABAC AuthorizationAttribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.Policy File FormatTo enable ABAC mode, specify --authorization-policy-file=SOME_FILENAME and --authorization-mode=ABAC on startup.The file format is one JSON object per line. There should be no enclosing list or map, only one map per line.Each line is a "policy object", where each such object is a map with the following properties:Versioning properties:apiVersion, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.kind, type string: valid values are "Policy". Allows versioning and conversion of the policy format.spec property set to a map with the following properties:Subject-matching properties:user, type string; the user-string from --token-auth-file. If you specify user, it must match the username of the authenticated user.group, type string; if you specify group, it must match one of the groups of the authenticated user. system:authenticated matches all authenticated requests. system:unauthenticated matches all unauthenticated requests.Resource-matching properties:apiGroup, type string; an API group.Ex: apps, networking.k8s.ioWildcard: * matches all API groups.namespace, type string; a namespace.Ex: kube-systemWildcard: * matches all resource requests.resource, type string; a resource typeEx: pods, deploymentsWildcard: * matches all resource requests.Non-resource-matching properties:nonResourcePath, type string; non-resource request paths.Ex: /version or /apisWildcard:* matches all non-resource requests./foo/* matches all subpaths of /foo/.readonly, type boolean, when true, means that the Resource-matching policy only applies to get, list, and watch operations, Non-resource-matching policy only applies to get operation.Note:An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). However, unset should be preferred for readability.In the future, policies may be expressed in a JSON format, and managed via a REST interface.Authorization AlgorithmA request has attributes which correspond to the properties of a policy object.When a request is received, the attributes are determined. Unknown attributes are set to the zero value of its type (e.g. empty string, 0, false).A property set to "*" will match any value of the corresponding attribute.The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation).To permit any authenticated user to do something, write a policy with the group property set to "system:authenticated".To permit any unauthenticated user to do something, write a policy with the group property set to "system:unauthenticated".To permit a user to do anything, write a pol


Question: What is Using ABAC Authorization?

Answer: A t t r i b u t e - b a s e d   a c c e s s   c o n t r o l   ( A B A C )   d e f i n e s   a n   a c c e s s   c o n t r o l   p a r a d i g m   w h e r e b y   a c c e s s   r i g h t s   a r e   g r a n t e d   t o   u s e r s   t h r o u g h   t h e   u s e   o f   p o l i c i e s   w h i c h   c o m b i n e   a t t r i b u t e s   t o g e t h e r .


Question: What is Policy File Format?

Answer: T o   e n a b l e   A B A C   m o d e ,   s p e c i f y   - - a u t h o r i z a t i o n - p o l i c y - f i l e = S O M E _ F I L E N A M E   a n d   - - a u t h o r i z a t i o n - m o d e = A B A C   o n   s t a r t u p .   T h e   f i l e   f o r m a t   i s   o n e   J S O N   o b j e c t   p e r   l i n e .   T h e r e   s h o u l d   b e   n o   e n c l o s i n g   l i s t   o r   m a p ,   o n l y   o n e   m a p   p e r   l i n e .   E a c h   l i n e   i s   a   " p o l i c y   o b j e c t " ,   w h e r e   e a c h   s u c h   o b j e c t   i s   a   m a p   w i t h   t h e   f o l l o w i n g   p r o p e r t i e s :   V e r s i o n i n g   p r o p e r t i e s : a p i V e r s i o n ,   t y p e   s t r i n g ;   v a l i d   v a l u e s   a r e   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " .   A l l o w s   v e r s i o n i n g   a n d   c o n v e r s i o n   o f   t h e   p o l i c y   f o r m a t . k i n d ,   t y p e   s t r i n g :   v a l i d   v a l u e s   a r e   " P o l i c y " .   A l l o w s   v e r s i o n i n g   a n d   c o n v e r s i o n   o f   t h e   p o l i c y   f o r m a t . s p e c   p r o p e r t y   s e t   t o   a   m a p   w i t h   t h e   f o l l o w i n g   p r o p e r t i e s : S u b j e c t - m a t c h i n g   p r o p e r t i e s : u s e r ,   t y p e   s t r i n g ;   t h e   u s e r - s t r i n g   f r o m   - - t o k e n - a u t h - f i l e .   I f   y o u   s p e c i f y   u s e r ,   i t   m u s t   m a t c h   t h e   u s e r n a m e   o f   t h e   a u t h e n t i c a t e d   u s e r . g r o u p ,   t y p e   s t r i n g ;   i f   y o u   s p e c i f y   g r o u p ,   i t   m u s t   m a t c h   o n e   o f   t h e   g r o u p s   o f   t h e   a u t h e n t i c a t e d   u s e r .   s y s t e m : a u t h e n t i c a t e d   m a t c h e s   a l l   a u t h e n t i c a t e d   r e q u e s t s .   s y s t e m : u n a u t h e n t i c a t e d   m a t c h e s   a l l   u n a u t h e n t


Question: What is Note:?

Answer: A n   u n s e t   p r o p e r t y   i s   t h e   s a m e   a s   a   p r o p e r t y   s e t   t o   t h e   z e r o   v a l u e   f o r   i t s   t y p e   ( e . g .   e m p t y   s t r i n g ,   0 ,   f a l s e ) .   H o w e v e r ,   u n s e t   s h o u l d   b e   p r e f e r r e d   f o r   r e a d a b i l i t y .   I n   t h e   f u t u r e ,   p o l i c i e s   m a y   b e   e x p r e s s e d   i n   a   J S O N   f o r m a t ,   a n d   m a n a g e d   v i a   a   R E S T   i n t e r f a c e .


Question: What is Authorization Algorithm?

Answer: A   r e q u e s t   h a s   a t t r i b u t e s   w h i c h   c o r r e s p o n d   t o   t h e   p r o p e r t i e s   o f   a   p o l i c y   o b j e c t .   W h e n   a   r e q u e s t   i s   r e c e i v e d ,   t h e   a t t r i b u t e s   a r e   d e t e r m i n e d .   U n k n o w n   a t t r i b u t e s   a r e   s e t   t o   t h e   z e r o   v a l u e   o f   i t s   t y p e   ( e . g .   e m p t y   s t r i n g ,   0 ,   f a l s e ) .   A   p r o p e r t y   s e t   t o   " * "   w i l l   m a t c h   a n y   v a l u e   o f   t h e   c o r r e s p o n d i n g   a t t r i b u t e .   T h e   t u p l e   o f   a t t r i b u t e s   i s   c h e c k e d   f o r   a   m a t c h   a g a i n s t   e v e r y   p o l i c y   i n   t h e   p o l i c y   f i l e .   I f   a t   l e a s t   o n e   l i n e   m a t c h e s   t h e   r e q u e s t   a t t r i b u t e s ,   t h e n   t h e   r e q u e s t   i s   a u t h o r i z e d   ( b u t   m a y   f a i l   l a t e r   v a l i d a t i o n ) .   T o   p e r m i t   a n y   a u t h e n t i c a t e d   u s e r   t o   d o   s o m e t h i n g ,   w r i t e   a   p o l i c y   w i t h   t h e   g r o u p   p r o p e r t y   s e t   t o   " s y s t e m : a u t h e n t i c a t e d " .   T o   p e r m i t   a n y   u n a u t h e n t i c a t e d   u s e r   t o   d o   s o m e t h i n g ,   w r i t e   a   p o l i c y   w i t h   t h e   g r o u p   p r o p e r t y   s e t   t o   " s y s t e m : u n a u t h e n t i c a t e d " .   T o   p e r m i t   a   u s e r   t o   d o   a n y t h i n g ,   w r i t e   a   p o l i c y   w i t h   t h e   a p i G r o u p ,   n a m e s p a c e ,   r e s o u r c e ,   a n d   n o n R e s o u r c e P a t h   p r o p e r t i e s   s e t   t o   " * " .


Question: What is Kubectl?

Answer: K u b e c t l   u s e s   t h e   / a p i   a n d   / a p i s   e n d p o i n t s   o f   a p i s e r v e r   t o   d i s c o v e r   s e r v e d   r e s o u r c e   t y p e s ,   a n d   v a l i d a t e s   o b j e c t s   s e n t   t o   t h e   A P I   b y   c r e a t e / u p d a t e   o p e r a t i o n s   u s i n g   s c h e m a   i n f o r m a t i o n   l o c a t e d   a t   / o p e n a p i / v 2 .   W h e n   u s i n g   A B A C   a u t h o r i z a t i o n ,   t h o s e   s p e c i a l   r e s o u r c e s   h a v e   t o   b e   e x p l i c i t l y   e x p o s e d   v i a   t h e   n o n R e s o u r c e P a t h   p r o p e r t y   i n   a   p o l i c y   ( s e e   e x a m p l e s   b e l o w ) :   / a p i ,   / a p i / * ,   / a p i s ,   a n d   / a p i s / *   f o r   A P I   v e r s i o n   n e g o t i a t i o n . / v e r s i o n   f o r   r e t r i e v i n g   t h e   s e r v e r   v e r s i o n   v i a   k u b e c t l   v e r s i o n . / s w a g g e r a p i / *   f o r   c r e a t e / u p d a t e   o p e r a t i o n s .   T o   i n s p e c t   t h e   H T T P   c a l l s   i n v o l v e d   i n   a   s p e c i f i c   k u b e c t l   o p e r a t i o n   y o u   c a n   t u r n   u p   t h e   v e r b o s i t y :   k u b e c t l   - - v = 8   v e r s i o n


Question: What is Examples?

Answer: A l i c e   c a n   d o   a n y t h i n g   t o   a l l   r e s o u r c e s : { " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   { " u s e r " :   " a l i c e " ,   " n a m e s p a c e " :   " * " ,   " r e s o u r c e " :   " * " ,   " a p i G r o u p " :   " * " } }   T h e   k u b e l e t   c a n   r e a d   a n y   p o d s : { " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   { " u s e r " :   " k u b e l e t " ,   " n a m e s p a c e " :   " * " ,   " r e s o u r c e " :   " p o d s " ,   " r e a d o n l y " :   t r u e } }   T h e   k u b e l e t   c a n   r e a d   a n d   w r i t e   e v e n t s : { " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   { " u s e r " :   " k u b e l e t " ,   " n a m e s p a c e " :   " * " ,   " r e s o u r c e " :   " e v e n t s " } }   B o b   c a n   j u s t   r e a d   p o d s   i n   n a m e s p a c e   " p r o j e c t C a r i b o u " : { " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   { " u s e r " :   " b o b " ,   " n a m e s p a c e " :   " p r o j e c t C a r i b o u " ,   " r e s o u r c e " :   " p o d s " ,   " r e a d o n l y " :   t r u e } }   A n y o n e   c a n   m a k e   r e a d - o n l y   r e q u e s t s   t o   a l l   n o n - r e s o u r c e   p a t h s : { " a p i V e r s i o n " :   " a b a c . a u t h o r i z a t i o n . k u b e r n e t e s . i o / v 1 b e t a 1 " ,   " k i n d " :   " P o l i c y " ,   " s p e c " :   { " g r o u p " :   " s y s t e m : a u t h e n t i c a t e d " ,   " r e a d o n l y " :   t r u e ,   " n o n R e s