Question: What is ClusterRoleBinding?

Answer: ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata (ObjectMeta)Standard object's metadata.roleRef (RoleRef), requiredRoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.RoleRef contains information that points to the role being usedroleRef.apiGroup (string), requiredAPIGroup is the group for the resource being referencedroleRef.kind (string), requiredKind is the type of resource being referencedroleRef.name (string), requiredName is the name of resource being referencedsubjects ([]Subject)Atomic: will be replaced during a mergeSubjects holds references to the objects the role applies to.Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.subjects.kind (string), requiredKind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.subjects.name (string), requiredName of the object being referenced.subjects.apiGroup (string)APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.subjects.namespace (string)Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.ClusterRoleBindingListClusterRoleBindingList is a collection of ClusterRoleBindingsapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRoleBinding), requiredItems is a list of ClusterRoleBindingsOperationsget read the specified ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}Parametersname (in path): string, requiredname of the ClusterRoleBindingpretty (in query): stringprettyResponse200 (ClusterRoleBinding): OK401: Unauthorizedlist list or watch objects of kind ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindingsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in


Question: How does ClusterRoleBinding work?

Answer: ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata (ObjectMeta)Standard object's metadata.roleRef (RoleRef), requiredRoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.RoleRef contains information that points to the role being usedroleRef.apiGroup (string), requiredAPIGroup is the group for the resource being referencedroleRef.kind (string), requiredKind is the type of resource being referencedroleRef.name (string), requiredName is the name of resource being referencedsubjects ([]Subject)Atomic: will be replaced during a mergeSubjects holds references to the objects the role applies to.Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.subjects.kind (string), requiredKind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.subjects.name (string), requiredName of the object being referenced.subjects.apiGroup (string)APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.subjects.namespace (string)Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.ClusterRoleBindingListClusterRoleBindingList is a collection of ClusterRoleBindingsapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRoleBinding), requiredItems is a list of ClusterRoleBindingsOperationsget read the specified ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}Parametersname (in path): string, requiredname of the ClusterRoleBindingpretty (in query): stringprettyResponse200 (ClusterRoleBinding): OK401: Unauthorizedlist list or watch objects of kind ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindingsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in


Question: When would you use ClusterRoleBinding?

Answer: ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata (ObjectMeta)Standard object's metadata.roleRef (RoleRef), requiredRoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.RoleRef contains information that points to the role being usedroleRef.apiGroup (string), requiredAPIGroup is the group for the resource being referencedroleRef.kind (string), requiredKind is the type of resource being referencedroleRef.name (string), requiredName is the name of resource being referencedsubjects ([]Subject)Atomic: will be replaced during a mergeSubjects holds references to the objects the role applies to.Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.subjects.kind (string), requiredKind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.subjects.name (string), requiredName of the object being referenced.subjects.apiGroup (string)APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.subjects.namespace (string)Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.ClusterRoleBindingListClusterRoleBindingList is a collection of ClusterRoleBindingsapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRoleBinding), requiredItems is a list of ClusterRoleBindingsOperationsget read the specified ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}Parametersname (in path): string, requiredname of the ClusterRoleBindingpretty (in query): stringprettyResponse200 (ClusterRoleBinding): OK401: Unauthorizedlist list or watch objects of kind ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindingsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in


Question: What are the benefits of ClusterRoleBinding?

Answer: ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata (ObjectMeta)Standard object's metadata.roleRef (RoleRef), requiredRoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.RoleRef contains information that points to the role being usedroleRef.apiGroup (string), requiredAPIGroup is the group for the resource being referencedroleRef.kind (string), requiredKind is the type of resource being referencedroleRef.name (string), requiredName is the name of resource being referencedsubjects ([]Subject)Atomic: will be replaced during a mergeSubjects holds references to the objects the role applies to.Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.subjects.kind (string), requiredKind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.subjects.name (string), requiredName of the object being referenced.subjects.apiGroup (string)APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.subjects.namespace (string)Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.ClusterRoleBindingListClusterRoleBindingList is a collection of ClusterRoleBindingsapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingListmetadata (ListMeta)Standard object's metadata.items ([]ClusterRoleBinding), requiredItems is a list of ClusterRoleBindingsOperationsget read the specified ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}Parametersname (in path): string, requiredname of the ClusterRoleBindingpretty (in query): stringprettyResponse200 (ClusterRoleBinding): OK401: Unauthorizedlist list or watch objects of kind ClusterRoleBindingHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/clusterrolebindingsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in


Question: What is ClusterRoleBinding?

Answer: a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / r b a c / v 1 "


Question: What is ClusterRoleBinding?

Answer: C l u s t e r R o l e B i n d i n g   r e f e r e n c e s   a   C l u s t e r R o l e ,   b u t   n o t   c o n t a i n   i t .   I t   c a n   r e f e r e n c e   a   C l u s t e r R o l e   i n   t h e   g l o b a l   n a m e s p a c e ,   a n d   a d d s   w h o   i n f o r m a t i o n   v i a   S u b j e c t .   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   C l u s t e r R o l e B i n d i n g m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . r o l e R e f   ( R o l e R e f ) ,   r e q u i r e d R o l e R e f   c a n   o n l y   r e f e r e n c e   a   C l u s t e r R o l e   i n   t h e   g l o b a l   n a m e s p a c e .   I f   t h e   R o l e R e f   c a n n o t   b e   r e s o l v e d ,   t h e   A u t h o r i z e r   m u s t   r e t u r n   a n   e r r o r .   T h i s   f i e l d   i s   i m m u t a b l e . R o l e R e f   c o n t a i n s   i n f o r m a t i o n   t h a t   p o i n t s   t o   t h e   r o l e   b e i n g   u s e d r o l e R e f . a p i G r o u p   ( s t r i n g ) ,   r e q u i r e d A P I G r o u p   i s   t h e   g r o u p   f o r   t h e   r e s o u r c e   b e i n g   r e f e r e n c e d r o l e R e f . k i n d   ( s t r i n g ) ,   r e q u i r e d K i n d   i s   t h e   t y p e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d r o l e R e f . n a m e   ( s t r i n g ) ,   r e q u i r e d N a m e   i s   t h e   n a m e   o f   r e s o u r c e   b e i n g   r e f e r e n c e d s u b j e c t s   ( [ ] S u b j e c t ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e S u b j e c t s   h o l d s   r e f e r e n c e s   t o   t h e   o b j e c t s   t h e   r o l e   a p p l i e s   t o . S u b j e c t   c o n t a i n s   a   r e f e r e n c e   t o   t h e   o b j e c t   o r   u s e r   i d e n t i t i e s   a   r o l e   b i n d i n g   a p p l i e s   t o .   T h i s   c a n   e i t h e r   h o l d   a   d i r


Question: What is ClusterRoleBindingList?

Answer: C l u s t e r R o l e B i n d i n g L i s t   i s   a   c o l l e c t i o n   o f   C l u s t e r R o l e B i n d i n g s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   C l u s t e r R o l e B i n d i n g L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . i t e m s   ( [ ] C l u s t e r R o l e B i n d i n g ) ,   r e q u i r e d I t e m s   i s   a   l i s t   o f   C l u s t e r R o l e B i n d i n g s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   k i n d :   C l u s t e r R o l e B i n d i n g L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   i t e m s   ( [ ] C l u s t e r R o l e B i n d i n g ) ,   r e q u i r e d   I t e m s   i s   a   l i s t   o f   C l u s t e r R o l e B i n d i n g s


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e B i n d i n g ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e B i n d i n g L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s


Question: What is Parameters?

Answer: b o d y :   C l u s t e r R o l e B i n d i n g ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   C l u s t e r R o l e B i n d i n g ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e B i n d i n g ) :   O K   2 0 1   ( C l u s t e r R o l e B i n d i n g ) :   C r e a t e d   2 0 2   ( C l u s t e r R o l e B i n d i n g ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g b o d y :   C l u s t e r R o l e B i n d i n g ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g   b o d y :   C l u s t e r R o l e B i n d i n g ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e B i n d i n g ) :   O K   2 0 1   ( C l u s t e r R o l e B i n d i n g ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C l u s t e r R o l e B i n d i n g ) :   O K   2 0 1   ( C l u s t e r R o l e B i n d i n g ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C l u s t e r R o l e B i n d i n g   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   2 0 2   ( S t a t u s ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / c l u s t e r r o l e b i n d i n g s


Question: What is Parameters?

Answer: b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   l a b e l S e l e c t o r   (


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Getting started?

Answer: This section lists the different ways to set up and run Kubernetes. When you install Kubernetes, choose an installation type based on: ease of maintenance, security, control, available resources, and expertise required to operate and manage a cluster.You can download Kubernetes to deploy a Kubernetes cluster on a local machine, into the cloud, or for your own datacenter.Several Kubernetes components such as kube-apiserver or kube-proxy can also be deployed as container images within the cluster.It is recommended to run Kubernetes components as container images wherever that is possible, and to have Kubernetes manage those components. Components that run containers - notably, the kubelet - can't be included in this category.If you don't want to manage a Kubernetes cluster yourself, you could pick a managed service, including certified platforms. There are also other standardized and custom solutions across a wide range of cloud and bare metal environments.Learning environmentIf you're learning Kubernetes, use the tools supported by the Kubernetes community, or tools in the ecosystem to set up a Kubernetes cluster on a local machine. See Install tools.Production environmentWhen evaluating a solution for a production environment, consider which aspects of operating a Kubernetes cluster (or abstractions) you want to manage yourself and which you prefer to hand off to a provider.For a cluster you're managing yourself, the officially supported tool for deploying Kubernetes is kubeadm.What's nextDownload KubernetesDownload and install tools including kubectlSelect a container runtime for your new clusterLearn about best practices for cluster setupKubernetes is designed for its control plane to run on Linux. Within your cluster you can run applications on Linux or other operating systems, including Windows.Learn to set up clusters with Windows nodes


Question: How does Getting started work?

Answer: This section lists the different ways to set up and run Kubernetes. When you install Kubernetes, choose an installation type based on: ease of maintenance, security, control, available resources, and expertise required to operate and manage a cluster.You can download Kubernetes to deploy a Kubernetes cluster on a local machine, into the cloud, or for your own datacenter.Several Kubernetes components such as kube-apiserver or kube-proxy can also be deployed as container images within the cluster.It is recommended to run Kubernetes components as container images wherever that is possible, and to have Kubernetes manage those components. Components that run containers - notably, the kubelet - can't be included in this category.If you don't want to manage a Kubernetes cluster yourself, you could pick a managed service, including certified platforms. There are also other standardized and custom solutions across a wide range of cloud and bare metal environments.Learning environmentIf you're learning Kubernetes, use the tools supported by the Kubernetes community, or tools in the ecosystem to set up a Kubernetes cluster on a local machine. See Install tools.Production environmentWhen evaluating a solution for a production environment, consider which aspects of operating a Kubernetes cluster (or abstractions) you want to manage yourself and which you prefer to hand off to a provider.For a cluster you're managing yourself, the officially supported tool for deploying Kubernetes is kubeadm.What's nextDownload KubernetesDownload and install tools including kubectlSelect a container runtime for your new clusterLearn about best practices for cluster setupKubernetes is designed for its control plane to run on Linux. Within your cluster you can run applications on Linux or other operating systems, including Windows.Learn to set up clusters with Windows nodes


Question: When would you use Getting started?

Answer: This section lists the different ways to set up and run Kubernetes. When you install Kubernetes, choose an installation type based on: ease of maintenance, security, control, available resources, and expertise required to operate and manage a cluster.You can download Kubernetes to deploy a Kubernetes cluster on a local machine, into the cloud, or for your own datacenter.Several Kubernetes components such as kube-apiserver or kube-proxy can also be deployed as container images within the cluster.It is recommended to run Kubernetes components as container images wherever that is possible, and to have Kubernetes manage those components. Components that run containers - notably, the kubelet - can't be included in this category.If you don't want to manage a Kubernetes cluster yourself, you could pick a managed service, including certified platforms. There are also other standardized and custom solutions across a wide range of cloud and bare metal environments.Learning environmentIf you're learning Kubernetes, use the tools supported by the Kubernetes community, or tools in the ecosystem to set up a Kubernetes cluster on a local machine. See Install tools.Production environmentWhen evaluating a solution for a production environment, consider which aspects of operating a Kubernetes cluster (or abstractions) you want to manage yourself and which you prefer to hand off to a provider.For a cluster you're managing yourself, the officially supported tool for deploying Kubernetes is kubeadm.What's nextDownload KubernetesDownload and install tools including kubectlSelect a container runtime for your new clusterLearn about best practices for cluster setupKubernetes is designed for its control plane to run on Linux. Within your cluster you can run applications on Linux or other operating systems, including Windows.Learn to set up clusters with Windows nodes


Question: What are the benefits of Getting started?

Answer: This section lists the different ways to set up and run Kubernetes. When you install Kubernetes, choose an installation type based on: ease of maintenance, security, control, available resources, and expertise required to operate and manage a cluster.You can download Kubernetes to deploy a Kubernetes cluster on a local machine, into the cloud, or for your own datacenter.Several Kubernetes components such as kube-apiserver or kube-proxy can also be deployed as container images within the cluster.It is recommended to run Kubernetes components as container images wherever that is possible, and to have Kubernetes manage those components. Components that run containers - notably, the kubelet - can't be included in this category.If you don't want to manage a Kubernetes cluster yourself, you could pick a managed service, including certified platforms. There are also other standardized and custom solutions across a wide range of cloud and bare metal environments.Learning environmentIf you're learning Kubernetes, use the tools supported by the Kubernetes community, or tools in the ecosystem to set up a Kubernetes cluster on a local machine. See Install tools.Production environmentWhen evaluating a solution for a production environment, consider which aspects of operating a Kubernetes cluster (or abstractions) you want to manage yourself and which you prefer to hand off to a provider.For a cluster you're managing yourself, the officially supported tool for deploying Kubernetes is kubeadm.What's nextDownload KubernetesDownload and install tools including kubectlSelect a container runtime for your new clusterLearn about best practices for cluster setupKubernetes is designed for its control plane to run on Linux. Within your cluster you can run applications on Linux or other operating systems, including Windows.Learn to set up clusters with Windows nodes


Question: What is Getting started?

Answer: K u b e r n e t e s   D o c u m e n t a t i o n   D o c u m e n t a t i o n   A v a i l a b l e   D o c u m e n t a t i o n   V e r s i o n s   G e t t i n g   s t a r t e d   L e a r n i n g   e n v i r o n m e n t   P r o d u c t i o n   e n v i r o n m e n t   C o n t a i n e r   R u n t i m e s   I n s t a l l i n g   K u b e r n e t e s   w i t h   d e p l o y m e n t   t o o l s   B o o t s t r a p p i n g   c l u s t e r s   w i t h   k u b e a d m   I n s t a l l i n g   k u b e a d m   T r o u b l e s h o o t i n g   k u b e a d m   C r e a t i n g   a   c l u s t e r   w i t h   k u b e a d m   C u s t o m i z i n g   c o m p o n e n t s   w i t h   t h e   k u b e a d m   A P I   O p t i o n s   f o r   H i g h l y   A v a i l a b l e   T o p o l o g y   C r e a t i n g   H i g h l y   A v a i l a b l e   C l u s t e r s   w i t h   k u b e a d m   S e t   u p   a   H i g h   A v a i l a b i l i t y   e t c d   C l u s t e r   w i t h   k u b e a d m   C o n f i g u r i n g   e a c h   k u b e l e t   i n   y o u r   c l u s t e r   u s i n g   k u b e a d m   D u a l - s t a c k   s u p p o r t   w i t h   k u b e a d m   T u r n k e y   C l o u d   S o l u t i o n s   B e s t   p r a c t i c e s   C o n s i d e r a t i o n s   f o r   l a r g e   c l u s t e r s   R u n n i n g   i n   m u l t i p l e   z o n e s   V a l i d a t e   n o d e   s e t u p   E n f o r c i n g   P o d   S e c u r i t y   S t a n d a r d s   P K I   c e r t i f i c a t e s   a n d   r e q u i r e m e n t s   C o n c e p t s   O v e r v i e w   K u b e r n e t e s   C o m p o n e n t s   O b j e c t s   I n   K u b e r n e t e s   K u b e r n e t e s   O b j e c t   M a n a g e m e n t   O b j e c t   N a m e s   a n d   I D s   L a b e l s   a n d   S e l e c t o r s   N a m e s p a c e s   A n n o t a t i o n s   F i e l d   S e l e c t o r s   F i n a l i z e r s   O w n e r s   a n d   D e p e n d e n t s   R e c o m m e n d e d   L a b e l s   T h e   K u b e r n e t e s


Question: What is Learning environment?

Answer: I f   y o u ' r e   l e a r n i n g   K u b e r n e t e s ,   u s e   t h e   t o o l s   s u p p o r t e d   b y   t h e   K u b e r n e t e s   c o m m u n i t y ,   o r   t o o l s   i n   t h e   e c o s y s t e m   t o   s e t   u p   a   K u b e r n e t e s   c l u s t e r   o n   a   l o c a l   m a c h i n e .   S e e   I n s t a l l   t o o l s .


Question: What is Production environment?

Answer: W h e n   e v a l u a t i n g   a   s o l u t i o n   f o r   a   p r o d u c t i o n   e n v i r o n m e n t ,   c o n s i d e r   w h i c h   a s p e c t s   o f   o p e r a t i n g   a   K u b e r n e t e s   c l u s t e r   ( o r   a b s t r a c t i o n s )   y o u   w a n t   t o   m a n a g e   y o u r s e l f   a n d   w h i c h   y o u   p r e f e r   t o   h a n d   o f f   t o   a   p r o v i d e r .   F o r   a   c l u s t e r   y o u ' r e   m a n a g i n g   y o u r s e l f ,   t h e   o f f i c i a l l y   s u p p o r t e d   t o o l   f o r   d e p l o y i n g   K u b e r n e t e s   i s   k u b e a d m .


Question: What is What's next?

Answer: D o w n l o a d   K u b e r n e t e s D o w n l o a d   a n d   i n s t a l l   t o o l s   i n c l u d i n g   k u b e c t l S e l e c t   a   c o n t a i n e r   r u n t i m e   f o r   y o u r   n e w   c l u s t e r L e a r n   a b o u t   b e s t   p r a c t i c e s   f o r   c l u s t e r   s e t u p   K u b e r n e t e s   i s   d e s i g n e d   f o r   i t s   c o n t r o l   p l a n e   t o   r u n   o n   L i n u x .   W i t h i n   y o u r   c l u s t e r   y o u   c a n   r u n   a p p l i c a t i o n s   o n   L i n u x   o r   o t h e r   o p e r a t i n g   s y s t e m s ,   i n c l u d i n g   W i n d o w s .   L e a r n   t o   s e t   u p   c l u s t e r s   w i t h   W i n d o w s   n o d e s


Question: What is Share Process Namespace between Containers in a Pod?

Answer: Share Process Namespace between Containers in a PodThis page shows how to configure process namespace sharing for a pod. When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod.You can use this feature to configure cooperating containers, such as a log handler sidecar container, or to troubleshoot container images that don't include debugging utilities like a shell.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesConfigure a PodProcess namespace sharing is enabled using the shareProcessNamespace field of .spec for a Pod. For example:pods/share-process-namespace.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: shareProcessNamespace: true containers: - name: nginx image: nginx - name: shell image: busybox:1.28 command: ["sleep", "3600"] securityContext: capabilities: add: - SYS_PTRACE stdin: true tty: true Create the pod nginx on your cluster:kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml Attach to the shell container and run ps:kubectl exec -it nginx -c shell -- /bin/sh If you don't see a command prompt, try pressing enter. In the container shell:# run this inside the "shell" container ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 14 101 0:00 nginx: worker process 15 root 0:00 sh 21 root 0:00 ps ax You can signal processes in other containers. For example, send SIGHUP to nginx to restart the worker process. This requires the SYS_PTRACE capability.# run this inside the "shell" container kill -HUP 8 # change "8" to match the PID of the nginx leader process, if necessary ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 15 root 0:00 sh 22 101 0:00 nginx: worker process 23 root 0:00 ps ax It's even possible to access the file system of another container using the /proc/$pid/root link.# run this inside the "shell" container # change "8" to the PID of the Nginx process, if necessary head /proc/8/root/etc/nginx/nginx.conf The output is similar to this:user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; Understanding process namespace sharingPods share many resources so it makes sense they would also share a process namespace. Some containers may expect to be isolated from others, though, so it's important to understand the differences:The container process no longer has PID 1. Some containers refuse to start without PID 1 (for exa


Question: How does Share Process Namespace between Containers in a Pod work?

Answer: Share Process Namespace between Containers in a PodThis page shows how to configure process namespace sharing for a pod. When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod.You can use this feature to configure cooperating containers, such as a log handler sidecar container, or to troubleshoot container images that don't include debugging utilities like a shell.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesConfigure a PodProcess namespace sharing is enabled using the shareProcessNamespace field of .spec for a Pod. For example:pods/share-process-namespace.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: shareProcessNamespace: true containers: - name: nginx image: nginx - name: shell image: busybox:1.28 command: ["sleep", "3600"] securityContext: capabilities: add: - SYS_PTRACE stdin: true tty: true Create the pod nginx on your cluster:kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml Attach to the shell container and run ps:kubectl exec -it nginx -c shell -- /bin/sh If you don't see a command prompt, try pressing enter. In the container shell:# run this inside the "shell" container ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 14 101 0:00 nginx: worker process 15 root 0:00 sh 21 root 0:00 ps ax You can signal processes in other containers. For example, send SIGHUP to nginx to restart the worker process. This requires the SYS_PTRACE capability.# run this inside the "shell" container kill -HUP 8 # change "8" to match the PID of the nginx leader process, if necessary ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 15 root 0:00 sh 22 101 0:00 nginx: worker process 23 root 0:00 ps ax It's even possible to access the file system of another container using the /proc/$pid/root link.# run this inside the "shell" container # change "8" to the PID of the Nginx process, if necessary head /proc/8/root/etc/nginx/nginx.conf The output is similar to this:user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; Understanding process namespace sharingPods share many resources so it makes sense they would also share a process namespace. Some containers may expect to be isolated from others, though, so it's important to understand the differences:The container process no longer has PID 1. Some containers refuse to start without PID 1 (for exa


Question: When would you use Share Process Namespace between Containers in a Pod?

Answer: Share Process Namespace between Containers in a PodThis page shows how to configure process namespace sharing for a pod. When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod.You can use this feature to configure cooperating containers, such as a log handler sidecar container, or to troubleshoot container images that don't include debugging utilities like a shell.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesConfigure a PodProcess namespace sharing is enabled using the shareProcessNamespace field of .spec for a Pod. For example:pods/share-process-namespace.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: shareProcessNamespace: true containers: - name: nginx image: nginx - name: shell image: busybox:1.28 command: ["sleep", "3600"] securityContext: capabilities: add: - SYS_PTRACE stdin: true tty: true Create the pod nginx on your cluster:kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml Attach to the shell container and run ps:kubectl exec -it nginx -c shell -- /bin/sh If you don't see a command prompt, try pressing enter. In the container shell:# run this inside the "shell" container ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 14 101 0:00 nginx: worker process 15 root 0:00 sh 21 root 0:00 ps ax You can signal processes in other containers. For example, send SIGHUP to nginx to restart the worker process. This requires the SYS_PTRACE capability.# run this inside the "shell" container kill -HUP 8 # change "8" to match the PID of the nginx leader process, if necessary ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 15 root 0:00 sh 22 101 0:00 nginx: worker process 23 root 0:00 ps ax It's even possible to access the file system of another container using the /proc/$pid/root link.# run this inside the "shell" container # change "8" to the PID of the Nginx process, if necessary head /proc/8/root/etc/nginx/nginx.conf The output is similar to this:user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; Understanding process namespace sharingPods share many resources so it makes sense they would also share a process namespace. Some containers may expect to be isolated from others, though, so it's important to understand the differences:The container process no longer has PID 1. Some containers refuse to start without PID 1 (for exa


Question: What are the benefits of Share Process Namespace between Containers in a Pod?

Answer: Share Process Namespace between Containers in a PodThis page shows how to configure process namespace sharing for a pod. When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod.You can use this feature to configure cooperating containers, such as a log handler sidecar container, or to troubleshoot container images that don't include debugging utilities like a shell.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesConfigure a PodProcess namespace sharing is enabled using the shareProcessNamespace field of .spec for a Pod. For example:pods/share-process-namespace.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: shareProcessNamespace: true containers: - name: nginx image: nginx - name: shell image: busybox:1.28 command: ["sleep", "3600"] securityContext: capabilities: add: - SYS_PTRACE stdin: true tty: true Create the pod nginx on your cluster:kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml Attach to the shell container and run ps:kubectl exec -it nginx -c shell -- /bin/sh If you don't see a command prompt, try pressing enter. In the container shell:# run this inside the "shell" container ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 14 101 0:00 nginx: worker process 15 root 0:00 sh 21 root 0:00 ps ax You can signal processes in other containers. For example, send SIGHUP to nginx to restart the worker process. This requires the SYS_PTRACE capability.# run this inside the "shell" container kill -HUP 8 # change "8" to match the PID of the nginx leader process, if necessary ps ax The output is similar to this:PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 15 root 0:00 sh 22 101 0:00 nginx: worker process 23 root 0:00 ps ax It's even possible to access the file system of another container using the /proc/$pid/root link.# run this inside the "shell" container # change "8" to the PID of the Nginx process, if necessary head /proc/8/root/etc/nginx/nginx.conf The output is similar to this:user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; Understanding process namespace sharingPods share many resources so it makes sense they would also share a process namespace. Some containers may expect to be isolated from others, though, so it's important to understand the differences:The container process no longer has PID 1. Some containers refuse to start without PID 1 (for exa


Question: What is Share Process Namespace between Containers in a Pod?

Answer: T h i s   p a g e   s h o w s   h o w   t o   c o n f i g u r e   p r o c e s s   n a m e s p a c e   s h a r i n g   f o r   a   p o d .   W h e n   p r o c e s s   n a m e s p a c e   s h a r i n g   i s   e n a b l e d ,   p r o c e s s e s   i n   a   c o n t a i n e r   a r e   v i s i b l e   t o   a l l   o t h e r   c o n t a i n e r s   i n   t h e   s a m e   p o d .   Y o u   c a n   u s e   t h i s   f e a t u r e   t o   c o n f i g u r e   c o o p e r a t i n g   c o n t a i n e r s ,   s u c h   a s   a   l o g   h a n d l e r   s i d e c a r   c o n t a i n e r ,   o r   t o   t r o u b l e s h o o t   c o n t a i n e r   i m a g e s   t h a t   d o n ' t   i n c l u d e   d e b u g g i n g   u t i l i t i e s   l i k e   a   s h e l l .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s


Question: What is Configure a Pod?

Answer: P r o c e s s   n a m e s p a c e   s h a r i n g   i s   e n a b l e d   u s i n g   t h e   s h a r e P r o c e s s N a m e s p a c e   f i e l d   o f   . s p e c   f o r   a   P o d .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   n g i n x   s p e c :   s h a r e P r o c e s s N a m e s p a c e :   t r u e   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   -   n a m e :   s h e l l   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [ " s l e e p " ,   " 3 6 0 0 " ]   s e c u r i t y C o n t e x t :   c a p a b i l i t i e s :   a d d :   -   S Y S _ P T R A C E   s t d i n :   t r u e   t t y :   t r u e   C r e a t e   t h e   p o d   n g i n x   o n   y o u r   c l u s t e r : k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s h a r e - p r o c e s s - n a m e s p a c e . y a m l   A t t a c h   t o   t h e   s h e l l   c o n t a i n e r   a n d   r u n   p s : k u b e c t l   e x e c   - i t   n g i n x   - c   s h e l l   - -   / b i n / s h   I f   y o u   d o n ' t   s e e   a   c o m m a n d   p r o m p t ,   t r y   p r e s s i n g   e n t e r .   I n   t h e   c o n t a i n e r   s h e l l : #   r u n   t h i s   i n s i d e   t h e   " s h e l l "   c o n t a i n e r   p s   a x   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : P I D   U S E R   T I M E   C O M M A N D   1   r o o t   0 : 0 0   / p a u s e   8   r o o t   0 : 0 0   n g i n x :   m a s t e r   p r o c e s s   n g i n x   - g   d a e m o n   o f f ;   1 4   1 0 1   0 : 0 0   n g i n x :   w o r k e r   p r o c e s s   1 5   r o o t   0 : 0 0   s h   2 1   r o o t   0 : 0 0   p s   a x   C r e a t e   t h e   p o d   n g i n x   o n   y o u r   c l u s t e r :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / s h a r e - p r o c e s s - n a m e s p a c e . y a m l   A t t a c h   t o   t h


Question: What is Understanding process namespace sharing?

Answer: P o d s   s h a r e   m a n y   r e s o u r c e s   s o   i t   m a k e s   s e n s e   t h e y   w o u l d   a l s o   s h a r e   a   p r o c e s s   n a m e s p a c e .   S o m e   c o n t a i n e r s   m a y   e x p e c t   t o   b e   i s o l a t e d   f r o m   o t h e r s ,   t h o u g h ,   s o   i t ' s   i m p o r t a n t   t o   u n d e r s t a n d   t h e   d i f f e r e n c e s :   T h e   c o n t a i n e r   p r o c e s s   n o   l o n g e r   h a s   P I D   1 .   S o m e   c o n t a i n e r s   r e f u s e   t o   s t a r t   w i t h o u t   P I D   1   ( f o r   e x a m p l e ,   c o n t a i n e r s   u s i n g   s y s t e m d )   o r   r u n   c o m m a n d s   l i k e   k i l l   - H U P   1   t o   s i g n a l   t h e   c o n t a i n e r   p r o c e s s .   I n   p o d s   w i t h   a   s h a r e d   p r o c e s s   n a m e s p a c e ,   k i l l   - H U P   1   w i l l   s i g n a l   t h e   p o d   s a n d b o x   ( / p a u s e   i n   t h e   a b o v e   e x a m p l e ) . P r o c e s s e s   a r e   v i s i b l e   t o   o t h e r   c o n t a i n e r s   i n   t h e   p o d .   T h i s   i n c l u d e s   a l l   i n f o r m a t i o n   v i s i b l e   i n   / p r o c ,   s u c h   a s   p a s s w o r d s   t h a t   w e r e   p a s s e d   a s   a r g u m e n t s   o r   e n v i r o n m e n t   v a r i a b l e s .   T h e s e   a r e   p r o t e c t e d   o n l y   b y   r e g u l a r   U n i x   p e r m i s s i o n s . C o n t a i n e r   f i l e s y s t e m s   a r e   v i s i b l e   t o   o t h e r   c o n t a i n e r s   i n   t h e   p o d   t h r o u g h   t h e   / p r o c / $ p i d / r o o t   l i n k .   T h i s   m a k e s   d e b u g g i n g   e a s i e r ,   b u t   i t   a l s o   m e a n s   t h a t   f i l e s y s t e m   s e c r e t s   a r e   p r o t e c t e d   o n l y   b y   f i l e s y s t e m   p e r m i s s i o n s .   T h e   c o n t a i n e r   p r o c e s s   n o   l o n g e r   h a s   P I D   1 .   S o m e   c o


Question: What is kubectl create service nodeport?

Answer: kubectl create service nodeportSynopsisCreate a NodePort service with the specified name.kubectl create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] Examples # Create a new NodePort service named my-ns kubectl create service nodeport my-ns --tcp=5678:8080 Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for nodeport--node-port intPort used to expose the service on each node in a cluster.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig contex


Question: How does kubectl create service nodeport work?

Answer: kubectl create service nodeportSynopsisCreate a NodePort service with the specified name.kubectl create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] Examples # Create a new NodePort service named my-ns kubectl create service nodeport my-ns --tcp=5678:8080 Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for nodeport--node-port intPort used to expose the service on each node in a cluster.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig contex


Question: When would you use kubectl create service nodeport?

Answer: kubectl create service nodeportSynopsisCreate a NodePort service with the specified name.kubectl create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] Examples # Create a new NodePort service named my-ns kubectl create service nodeport my-ns --tcp=5678:8080 Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for nodeport--node-port intPort used to expose the service on each node in a cluster.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig contex


Question: What are the benefits of kubectl create service nodeport?

Answer: kubectl create service nodeportSynopsisCreate a NodePort service with the specified name.kubectl create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] Examples # Create a new NodePort service named my-ns kubectl create service nodeport my-ns --tcp=5678:8080 Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for nodeport--node-port intPort used to expose the service on each node in a cluster.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig contex


Question: What is Synopsis?

Answer: C r e a t e   a   N o d e P o r t   s e r v i c e   w i t h   t h e   s p e c i f i e d   n a m e .   k u b e c t l   c r e a t e   s e r v i c e   n o d e p o r t   N A M E   [ - - t c p = p o r t : t a r g e t P o r t ]   [ - - d r y - r u n = s e r v e r | c l i e n t | n o n e ]


Question: What is Examples?

Answer: #   C r e a t e   a   n e w   N o d e P o r t   s e r v i c e   n a m e d   m y - n s   k u b e c t l   c r e a t e   s e r v i c e   n o d e p o r t   m y - n s   - - t c p = 5 6 7 8 : 8 0 8 0


Question: What is Options?

Answer: I f   t r u e ,   i g n o r e   a n y   e r r o r s   i n   t e m p l a t e s   w h e n   a   f i e l d   o r   m a p   k e y   i s   m i s s i n g   i n   t h e   t e m p l a t e .   O n l y   a p p l i e s   t o   g o l a n g   a n d   j s o n p a t h   o u t p u t   f o r m a t s .   M u s t   b e   " n o n e " ,   " s e r v e r " ,   o r   " c l i e n t " .   I f   c l i e n t   s t r a t e g y ,   o n l y   p r i n t   t h e   o b j e c t   t h a t   w o u l d   b e   s e n t ,   w i t h o u t   s e n d i n g   i t .   I f   s e r v e r   s t r a t e g y ,   s u b m i t   s e r v e r - s i d e   r e q u e s t   w i t h o u t   p e r s i s t i n g   t h e   r e s o u r c e .   N a m e   o f   t h e   m a n a g e r   u s e d   t o   t r a c k   f i e l d   o w n e r s h i p .   h e l p   f o r   n o d e p o r t   P o r t   u s e d   t o   e x p o s e   t h e   s e r v i c e   o n   e a c h   n o d e   i n   a   c l u s t e r .   O u t p u t   f o r m a t .   O n e   o f :   ( j s o n ,   y a m l ,   n a m e ,   g o - t e m p l a t e ,   g o - t e m p l a t e - f i l e ,   t e m p l a t e ,   t e m p l a t e f i l e ,   j s o n p a t h ,   j s o n p a t h - a s - j s o n ,   j s o n p a t h - f i l e ) .   I f   t r u e ,   t h e   c o n f i g u r a t i o n   o f   c u r r e n t   o b j e c t   w i l l   b e   s a v e d   i n   i t s   a n n o t a t i o n .   O t h e r w i s e ,   t h e   a n n o t a t i o n   w i l l   b e   u n c h a n g e d .   T h i s   f l a g   i s   u s e f u l   w h e n   y o u   w a n t   t o   p e r f o r m   k u b e c t l   a p p l y   o n   t h i s   o b j e c t   i n   t h e   f u t u r e .   I f   t r u e ,   k e e p   t h e   m a n a g e d F i e l d s   w h e n   p r i n t i n g   o b j e c t s   i n   J S O N   o r   Y A M L   f o r m a t .   P o r t   p a i r s   c a n   b e   s p e c i f i e d   a s   ' < p o r t > : < t a r g e t P o r t > ' .   T e m p l a t e   s t r i n g   o r   p a t h   t o   t e m p l a t e   f i l e   t


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   c r e a t e   s e r v i c e   -   C r e a t e   a   s e r v i c e   u s i n g   a   s p e c i f i e d   s u b c o m m a n d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Client Authentication (v1)?

Answer: Client Authentication (v1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec holds requ


Question: How does Client Authentication (v1) work?

Answer: Client Authentication (v1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec holds requ


Question: When would you use Client Authentication (v1)?

Answer: Client Authentication (v1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec holds requ


Question: What are the benefits of Client Authentication (v1)?

Answer: Client Authentication (v1)Resource TypesExecCredentialExecCredentialExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.FieldDescriptionapiVersionstringclient.authentication.k8s.io/v1kindstringExecCredentialspec [Required]ExecCredentialSpecSpec holds information passed to the plugin by the transport.statusExecCredentialStatusStatus is filled in by the plugin and holds the credentials that the transport should use to contact the API.ClusterAppears in:ExecCredentialSpecCluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.FieldDescriptionserver [Required]stringServer is the address of the kubernetes cluster (https://hostname:port).tls-server-namestringTLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.insecure-skip-tls-verifyboolInsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.certificate-authority-data[]byteCAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.proxy-urlstringProxyURL is the URL to the proxy to be used for all requests to this cluster.disable-compressionboolDisableCompression allows client to opt-out of response compression for all requests to the server. This is useful to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.configk8s.io/apimachinery/pkg/runtime.RawExtensionConfig holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to.This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field:clusters:name: my-cluster cluster: ... extensions:name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary configIn some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.ExecCredentialSpecAppears in:ExecCredentialExecCredentialSpec holds requ


Question: What is Resource Types?

Answer: E x e c C r e d e n t i a l


Question: What is ExecCredential?

Answer: E x e c C r e d e n t i a l   i s   u s e d   b y   e x e c - b a s e d   p l u g i n s   t o   c o m m u n i c a t e   c r e d e n t i a l s   t o   H T T P   t r a n s p o r t s .   S p e c   h o l d s   i n f o r m a t i o n   p a s s e d   t o   t h e   p l u g i n   b y   t h e   t r a n s p o r t .   S t a t u s   i s   f i l l e d   i n   b y   t h e   p l u g i n   a n d   h o l d s   t h e   c r e d e n t i a l s   t h a t   t h e   t r a n s p o r t   s h o u l d   u s e   t o   c o n t a c t   t h e   A P I .


Question: What is Cluster?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l S p e c   C l u s t e r   c o n t a i n s   i n f o r m a t i o n   t o   a l l o w   a n   e x e c   p l u g i n   t o   c o m m u n i c a t e   w i t h   t h e   k u b e r n e t e s   c l u s t e r   b e i n g   a u t h e n t i c a t e d   t o .   T o   e n s u r e   t h a t   t h i s   s t r u c t   c o n t a i n s   e v e r y t h i n g   s o m e o n e   w o u l d   n e e d   t o   c o m m u n i c a t e   w i t h   a   k u b e r n e t e s   c l u s t e r   ( j u s t   l i k e   t h e y   w o u l d   v i a   a   k u b e c o n f i g ) ,   t h e   f i e l d s   s h o u l d   s h a d o w   " k 8 s . i o / c l i e n t - g o / t o o l s / c l i e n t c m d / a p i / v 1 " . C l u s t e r ,   w i t h   t h e   e x c e p t i o n   o f   C e r t i f i c a t e A u t h o r i t y ,   s i n c e   C A   d a t a   w i l l   a l w a y s   b e   p a s s e d   t o   t h e   p l u g i n   a s   b y t e s .   S e r v e r   i s   t h e   a d d r e s s   o f   t h e   k u b e r n e t e s   c l u s t e r   ( h t t p s : / / h o s t n a m e : p o r t ) .   T L S S e r v e r N a m e   i s   p a s s e d   t o   t h e   s e r v e r   f o r   S N I   a n d   i s   u s e d   i n   t h e   c l i e n t   t o   c h e c k   s e r v e r   c e r t i f i c a t e s   a g a i n s t .   I f   S e r v e r N a m e   i s   e m p t y ,   t h e   h o s t n a m e   u s e d   t o   c o n t a c t   t h e   s e r v e r   i s   u s e d .   I n s e c u r e S k i p T L S V e r i f y   s k i p s   t h e   v a l i d i t y   c h e c k   f o r   t h e   s e r v e r ' s   c e r t i f i c a t e .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e .   C A D a t a   c o n t a i n s   P E M - e n c o d e d   c e r t i f i c a t e   a u t h o r i t y   c e r t i f i c a t e s .   I f   e m p t y ,   s y s t e m   r o o t s   s h o u l d   b e   u s e d .   P r o x y U R L   i s   t h e   U R L   t o   t h e   p r o x y   t o   b


Question: What is ExecCredentialSpec?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l   E x e c C r e d e n t i a l S p e c   h o l d s   r e q u e s t   a n d   r u n t i m e   s p e c i f i c   i n f o r m a t i o n   p r o v i d e d   b y   t h e   t r a n s p o r t .   C l u s t e r   c o n t a i n s   i n f o r m a t i o n   t o   a l l o w   a n   e x e c   p l u g i n   t o   c o m m u n i c a t e   w i t h   t h e   k u b e r n e t e s   c l u s t e r   b e i n g   a u t h e n t i c a t e d   t o .   N o t e   t h a t   C l u s t e r   i s   n o n - n i l   o n l y   w h e n   p r o v i d e C l u s t e r I n f o   i s   s e t   t o   t r u e   i n   t h e   e x e c   p r o v i d e r   c o n f i g   ( i . e . ,   E x e c C o n f i g . P r o v i d e C l u s t e r I n f o ) .   I n t e r a c t i v e   d e c l a r e s   w h e t h e r   s t d i n   h a s   b e e n   p a s s e d   t o   t h i s   e x e c   p l u g i n .


Question: What is ExecCredentialStatus?

Answer: A p p e a r s   i n :   E x e c C r e d e n t i a l   E x e c C r e d e n t i a l S t a t u s   h o l d s   c r e d e n t i a l s   f o r   t h e   t r a n s p o r t   t o   u s e .   T o k e n   a n d   C l i e n t K e y D a t a   a r e   s e n s i t i v e   f i e l d s .   T h i s   d a t a   s h o u l d   o n l y   b e   t r a n s m i t t e d   i n - m e m o r y   b e t w e e n   c l i e n t   a n d   e x e c   p l u g i n   p r o c e s s .   E x e c   p l u g i n   i t s e l f   s h o u l d   a t   l e a s t   b e   p r o t e c t e d   v i a   f i l e   p e r m i s s i o n s .   E x p i r a t i o n T i m e s t a m p   i n d i c a t e s   a   t i m e   w h e n   t h e   p r o v i d e d   c r e d e n t i a l s   e x p i r e .   T o k e n   i s   a   b e a r e r   t o k e n   u s e d   b y   t h e   c l i e n t   f o r   r e q u e s t   a u t h e n t i c a t i o n .   P E M - e n c o d e d   c l i e n t   T L S   c e r t i f i c a t e s   ( i n c l u d i n g   i n t e r m e d i a t e s ,   i f   a n y ) .   P E M - e n c o d e d   p r i v a t e   k e y   f o r   t h e   a b o v e   c e r t i f i c a t e .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Pod Security Standards?

Answer: Pod Security StandardsA detailed look at the different policy levels defined in the Pod Security Standards.The Pod Security Standards define three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive. This guide outlines the requirements of each policy.ProfileDescriptionPrivilegedUnrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.BaselineMinimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration.RestrictedHeavily restricted policy, following current Pod hardening best practices.Profile DetailsPrivilegedThe Privileged policy is purposely-open, and entirely unrestricted. This type of policy is typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.The Privileged policy is defined by an absence of restrictions. If you define a Pod where the Privileged security policy applies, the Pod you define is able to bypass typical container isolation mechanisms. For example, you can define a Pod that has access to the node's host network.BaselineThe Baseline policy is aimed at ease of adoption for common containerized workloads while preventing known privilege escalations. This policy is targeted at application operators and developers of non-critical applications. The following listed controls should be enforced/disallowed:Note:In this table, wildcards (*) indicate all elements in a list. For example, spec.containers[*].securityContext refers to the Security Context object for all defined containers. If any of the listed containers fails to meet the requirements, the entire pod will fail validation.Baseline policy specificationControlPolicyHostProcessWindows Pods offer the ability to run HostProcess containers which enables privileged access to the Windows host machine. Privileged access to the host is disallowed in the Baseline policy.FEATURE STATE: Kubernetes v1.26 [stable]Restricted Fieldsspec.securityContext.windowsOptions.hostProcessspec.containers[*].securityContext.windowsOptions.hostProcessspec.initContainers[*].securityContext.windowsOptions.hostProcessspec.ephemeralContainers[*].securityContext.windowsOptions.hostProcessAllowed ValuesUndefined/nilfalseHost NamespacesSharing the host namespaces must be disallowed.Restricted Fieldsspec.hostNetworkspec.hostPIDspec.hostIPCAllowed ValuesUndefined/nilfalsePrivileged ContainersPrivileged Pods disable most security mechanisms and must be disallowed.Restricted Fieldsspec.containers[*].securityContext.privilegedspec.initContainers[*].securityContext.privilegedspec.ephemeralContainers[*].securityContext.privilegedAllowed ValuesUndefined/nilfalseCapabilitiesAdding additional capabilities beyond those listed below must be disallowed.Restricted Fieldsspec.containers[*].securityContext.capabilities.addspec.initContainers[*].securityContex


Question: How does Pod Security Standards work?

Answer: Pod Security StandardsA detailed look at the different policy levels defined in the Pod Security Standards.The Pod Security Standards define three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive. This guide outlines the requirements of each policy.ProfileDescriptionPrivilegedUnrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.BaselineMinimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration.RestrictedHeavily restricted policy, following current Pod hardening best practices.Profile DetailsPrivilegedThe Privileged policy is purposely-open, and entirely unrestricted. This type of policy is typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users.The Privileged policy is defined by an absence of restrictions. If you define a Pod where the Privileged security policy applies, the Pod you define is able to bypass typical container isolation mechanisms. For example, you can define a Pod that has access to the node's host network.BaselineThe Baseline policy is aimed at ease of adoption for common containerized workloads while preventing known privilege escalations. This policy is targeted at application operators and developers of non-critical applications. The following listed controls should be enforced/disallowed:Note:In this table, wildcards (*) indicate all elements in a list. For example, spec.containers[*].securityContext refers to the Security Context object for all defined containers. If any of the listed containers fails to meet the requirements, the entire pod will fail validation.Baseline policy specificationControlPolicyHostProcessWindows Pods offer the ability to run HostProcess containers which enables privileged access to the Windows host machine. Privileged access to the host is disallowed in the Baseline policy.FEATURE STATE: Kubernetes v1.26 [stable]Restricted Fieldsspec.securityContext.windowsOptions.hostProcessspec.containers[*].securityContext.windowsOptions.hostProcessspec.initContainers[*].securityContext.windowsOptions.hostProcessspec.ephemeralContainers[*].securityContext.windowsOptions.hostProcessAllowed ValuesUndefined/nilfalseHost NamespacesSharing the host namespaces must be disallowed.Restricted Fieldsspec.hostNetworkspec.hostPIDspec.hostIPCAllowed ValuesUndefined/nilfalsePrivileged ContainersPrivileged Pods disable most security mechanisms and must be disallowed.Restricted Fieldsspec.containers[*].securityContext.privilegedspec.initContainers[*].securityContext.privilegedspec.ephemeralContainers[*].securityContext.privilegedAllowed ValuesUndefined/nilfalseCapabilitiesAdding additional capabilities beyond those listed below must be disallowed.Restricted Fieldsspec.containers[*].securityContext.capabilities.addspec.initContainers[*].securityContex